> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://hiddenlayer.ferndocs.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://hiddenlayer.ferndocs.com/_mcp/server. # Supply Chain Detection Categories and Severity Levels AI Supply Chain Security defines attacks by technique, providing an estimated severity and the rationality for classifying it with that severity. | Detection Category | Estimated Severity | Definition | Rationality for Severity | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ----------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | ----------- | -------------------------- | --------------------------------------------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------- | ---------------------------------------------------------- | ----------- | --------------------------------- | --------------------------------------------------------- | -------------------------------------------------------- | -------------------------- | --------------------------------------------------------- | -------------------------------------------------------- | -------------- | --------------------------------------------------------- | -------------------------------------------------------- | ------------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | Arbitrary Code Execution | Critical | Adversaries can inject malicious code into a model, which will be executed whenever the hijacked model is loaded into memory. This vulnerability can be used to exfiltrate sensitive data, execute malware (such as spyware or ransomware) on the machine, or run any kind of malicious scripts. | Cloudpickle: .pkl, .pickle | Dill: .dill | GGUF: .gguf | HDF5: .h5, .hdf5 | JobLib: .joblib | Keras: .keras | NeMo: .nemo | Numpy: .npy, .npz | Pytorch: .pt, .bin, pth, ckpt | Pickle: .pkl | R: .rds (plain and compressed) | Skops: .skops | Arbitrary code execution attacks are relatively easy to perform and may lead to critical outcomes such as execution of malicious code on an organization's computers. | Vulnerable Formats: | CloudPickle | Joblib | Keras | Nemo | Pickle | R | skops | HiddenLayer Tech Blogs: | [R-bitrary Code Execution](https://hiddenlayer.com/research/r-bitrary-code-execution/) | [Security Advisory: 2024-06-skops](https://hiddenlayer.com/sai-security-advisory/2024-06-skops/) | [Models are Code](https://hiddenlayer.com/research/models-are-code/) | [CWE-502](https://cwe.mitre.org/data/definitions/502.html) | MITRE ATLAS | Command and Scripting Interpreter | [AML T0050](https://atlas.mitre.org/techniques/AML.T0050) | [AML TA0005](https://atlas.mitre.org/tactics/AML.TA0005) | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | User Execution | [AML T0011](https://atlas.mitre.org/techniques/AML.T0011) | [AML TA0005](https://atlas.mitre.org/tactics/AML.TA0005) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | Arbitrary Read Access | High | Adversaries can craft a malicious model that will exfiltrate sensitive data upon loading. | ONNX: .onnx | Arbitrary read access attacks are relatively easy to perform and may lead to critical outcomes such as an attacker exfiltrating sensitive data. | Vulnerable Formats: | PMML | SavedModel | [HiddenLayer Tech Blog: Models are Code](https://hiddenlayer.com/research/models-are-code/) | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | | | | | | | | | | | | | Control Vector | High | Adversaries can inject a control vector into the computational graph of a model introducing refusal ablation or custom, attacker-defined behaviors. | All model formats | Inserted control vectors can control or modify model behavior as well as can be used to remove refusals on a secured model. | Vulnerable Formats: | All model formats | MITRE ATLAS | Backdoor ML Model: Inject Payload | [AML T0018.001](https://atlas.mitre.org/techniques/AML.T0018.001) | [AML TA0006](https://atlas.mitre.org/tactics/AML.TA0006) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Decompression Vulnerabilities | High | Adversaries can exploit vulnerabilities in popular compression formats to cause denial of service or leak sensitive data. | Keras: .keras | NeMo: .nemo | Safetensors: .safetensors | Tensorflow: .savedmodel, .tf, .pb | Zip: .zip | Decompression vulnerabilities are relatively easy to exploit and may lead to high-impact outcomes such as denial of service, code execution, or data leakage. | Vulnerable Formats: | PyTorch | Tar | Zip | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | | | | | | | | | Denial of Service | Medium | Adversaries can craft a malicious model, or modify legitimately pre-trained model, in order to disrupt the system the model will be loaded on. | Cloudpickle: .pkl, .pickle | Dill: .dill | HDF5: .h5, .hdf5 | JobLib: .joblib | NeMo: .nemo | Numpy: .npy, .npz | Pytorch: .pt, .bin, pth, ckpt | Pickle: .pkl | Denial of service attacks are relatively easy to perform and may lead to disruption or degradation of service. | Vulnerable Formats: | All model formats | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | | | | | | | | Directory Traversal | Medium | Adversaries can craft a malicious model, or modify legitimately pre-trained model, in order to gain unauthorised access to sensitive files on the system. | ONNX: .onnx | Directory traversal attacks are relatively easy to perform and may grant an attacker access to sensitive files on the file system. | Vulnerable Formats: | ONNX | [HiddenLayer Tech Blog: ONNX Vulnerability Report](https://hiddenlayer.com/sai-security-advisory/2024-02-onnx/) | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Embedded Payloads | Low | Adversaries can embed malicious payloads (such as backdoors, coin miners, spyware, and ransomware) inside the model’s tensors. Such payloads can be injected in plain text, obfuscated, or embedded using steganography. | HDF5: .h5, .hdf5 | Safetensors: .safetensors | Malicious payloads can be embedded in ML models relatively easily; this may lead to malware components being distributed on an organization's computers. | Vulnerable Formats: | All model formats | HiddenLayer Tech Blogs: | [Weaponizing Machine Learning Models with Ransomware](https://hiddenlayer.com/research/weaponizing-machine-learning-models-with-ransomware/) | [Pickle Files](https://hiddenlayer.com/research/pickle-strike/) | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | | | | | | | | | | | Graph Payload | High | Adversaries can inject a computational graph payload, introducing a secret attacker-controlled behavior into a pre-trained model. | ONNX: .onnx | Model backdooring may be relatively difficult to perform and can lead to critical outcomes such as biased or inaccurate output. | [HiddenLayer Tech Blog: Shadow Logic](https://hiddenlayer.com/research/shadowlogic/) | Vulnerable Formats | All model formats | MITRE ATLAS | Backdoor ML Model: Inject Payload | [AML T0018.001](https://atlas.mitre.org/techniques/AML.T0018.001) | [AML TA0006](https://atlas.mitre.org/tactics/AML.TA0006) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Model Sideloading | High | Adversaries can load code or model artifacts from an unexpected location bypassing checks performed on the model. | Pickle: .pkl | Model sideloading is not expected behavior and typically points to an attempt to obfuscate a payload. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Network Requests | High | Adversaries can craft a malicious model that will make network requests upon loading. | Cloudpickle: .pkl, .pickle | Dill: .dill | HDF5: .h5, .hdf5 | JobLib: .joblib | NeMo: .nemo | Numpy: .npy, .npz | Pytorch: .pt, .bin, pth, ckpt | Pickle: .pkl | Network requests are relatively easy to perform and may be used to exfiltrate data, download payloads, or initiate command and control communications. | Vulnerable Formats: | CloudPickle | Joblib | Keras | Nemo | Pickle | R | skops | [HiddenLayer Tech Blog: Pickle Files](https://hiddenlayer.com/research/pickle-strike/) | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | OWASP Top 10: | [ML06](https://mltop10.info/ML06_2023-AI_Supply_Chain_Attacks) | [LLM05](https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities) | | | | | | | | | | | | | | | | Repository Sideloading | Medium | Adversaries can load code or model artifacts from an unexpected location, bypassing checks performed on the artifacts in the repository. | Repository sideloading is an expected behavior allowed by Hugging Face; however, it can be abused to bypass security checks. | Vulnerable Formats | JSON | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Suspicious File Format | Medium | Adversaries can modify data structures and encodings in an attempt to evade detection. | Cloudpickle: .pkl, .pickle | Dill: .dill | HDF5: .h5, .hdf5 | JobLib: .joblib | NeMo: .nemo | Numpy: .npy, .npz | Pytorch: .pt, .bin, pth, ckpt | Pickle: .pkl | File format tampering is usually indicative of a targeted attack. | Vulnerable Formats: | Pickle | ProtoBuf | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | | | | | | | | | | | | | | | | | | | | | | | | | Suspicious Functions | High | The presence of these functions themselves is not inherently malicious, but they can be used in conjunction with other functions to create a malicious model. | Cloudpickle: .pkl, .pickle | Dill: .dill | HDF5: .h5, .hdf5 | JobLib: .joblib | NeMo: .nemo | Numpy: .npy, .npz | Pytorch: .pt, .bin, pth, ckpt | Pickle: .pkl | Functions can be used in conjunction with other functions to create a malicious model. | Vulnerable Formats: | Pickle | MITRE ATLAS | ML Supply Chain Compromise | [AML T0010](https://atlas.mitre.org/techniques/AML.T0010) | [AML TA0004](https://atlas.mitre.org/tactics/AML.TA0004) | | | | | | | | | | | | | | | | | | | | | | | | | | TokenBreak | High | Adversaries can exploit a weakness in the tokenizer to bypass model classifications. | Models susceptible to the tokenbreak vulnerability can have their classifications altered on command by an attacker resulting in a weakness wherever the model is used. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |