ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks

2026-07-19

AI Summary

This work addresses the underexplored threat of supply chain attacks targeting pre-trained models hosted on model-sharing platforms, where existing scanners struggle to detect stealthy malicious payloads. The authors propose ShadowPickle, a novel attack framework that systematically exposes a critical security blind spot in Pickle deserialization—specifically, the unsafe import of external modules—and enables highly evasive attacks through dynamic payload injection and module hijacking. To better evaluate such threats, they introduce PickleBench, a more challenging dynamic benchmark. Experimental results demonstrate that ShadowPickle achieves an average evasion rate of 63% against ten mainstream scanners and four popular model platforms, representing up to a 50% improvement over current methods, while PickleBench increases detection difficulty by 25.6% compared to existing benchmarks.

Abstract

Model hosting hubs (e.g., Hugging Face) are vulnerable to supply chain attacks that enable remote code execution on trusted user environments. Attackers often distribute malicious Pre-trained ML models (PTMs) via model hubs. In this paper, we present novel attacks against PTMs and model hubs called SHADOWPICKLE. SHADOWPICKLE includes three (3) stealthy pickle deserialization attacks that enable malicious behaviors and evade state-of-the-art (SOTA) model scanners. These attacks leverage the external module import mechanism of the Pickle Virtual Machine (VM) to execute malicious payloads during deserialization. Additionally, we provide PICKLEBENCH, a dynamic and extensible benchmark for automatically injecting SHADOWPICKLE into arbitrary benign PTM models. Our evaluation shows that SHADOWPICKLE evades ten SOTA scanners, and four model hubs. SHADOWPICKLE (Overwritten) has a 63% evasion rate across scanners, and up to 50% higher evasion rates than existing attacks. Besides, PICKLEBENCH is up to 25.6% more challenging than three SOTA benchmarks. Finally, we provide security recommendations for mitigating our attacks and improving the effectiveness of existing scanners. Our findings highlight the limitations of existing PTM scanners and suggest directions for improvements.

Problem

• Pickle deserialization
• machine learning supply chain attacks
• pre-trained model security
• model scanner evasion
• malicious PTMs

Innovation

• Pickle deserialization
• stealthy attacks
• model supply chain security
• evasion techniques
• PICKLEBENCH