Package: picklescan
Python Pickle Malware ScannerSecurity scanner detecting Python Pickle files performing suspicious actions.For more generic model scanning, Protect AI'smodelscanis now available to scan not only Pickle files but
also PyTorch, TensorFlow, and Keras.Getting startedScan a malicious model onHugging Face:pipinstallpicklescan
picklescan--huggingfaceykilcher/totally-harmless-modelThe scanner reports that the Pickle is callingeval()to execute arbitrary code:https://huggingface.co/ykilcher/totally-harmless-model/resolve/main/pytorch_model.bin:archive/data.pkl:globalimport'__builtin__ eval'FOUND
-----------SCANSUMMARY-----------
Scannedfiles:1Infectedfiles:1Dangerousglobals:1The scanner can also load Pickles from local files, directories, URLs, and zip archives (a-laPyTorch):picklescan--pathdownloads/pytorch_model.bin
picklescan--pathdownloads
picklescan--urlhttps://huggingface.co/sshleifer/tiny-distilbert-base-cased-distilled-squad/resolve/main/pytorch_model.binTo scan Numpy's.npyfiles, pip install thenumpypackage first.The scanner exit status codes are (a-laClamAV):0: scan did not find malware1: scan found malware2: scan failedDevelopCreate and activate the conda environment (minicondais sufficient):conda env create -f conda.yaml
conda activate picklescanInstall the package in editable mode to develop and test:python3 -m pip install -e .Edit withVS Code:code .Run unit tests:pytest testsRun manual tests:Local PyTorch (zip) filemkdirdownloads
wget-Odownloads/pytorch_model.binhttps://huggingface.co/ykilcher/totally-harmless-model/resolve/main/pytorch_model.bin
picklescan-lDEBUG-pdownloads/pytorch_model.binRemote PyTorch (zip) URLpicklescan-lDEBUG-uhttps://huggingface.co/prajjwal1/bert-tiny/resolve/main/pytorch_model.binLint the code:black src tests
flake8 src tests --count --show-sourcePublish the package toPyPI: bump the package version insetup.cfgand create a GitHub release. This triggers thepublishworkflow.Alternative manual steps to publish the package:python3 -m pip install --upgrade pip
python3 -m pip install --upgrade build
python3 -m build
python3 -m twine upload dist/*Test the package: bump the version ofpicklescaninconda.test.yamland runconda env remove -n picklescan-test
conda env create -f conda.test.yaml
conda activate picklescan-test
picklescan --huggingface ykilcher/totally-harmless-modelTested onLinux 5.10.102.1-microsoft-standard-WSL2 x86_64(WSL2).Referencespickletools.py-- The pickletool code is the most detailed documentation of the Pickle format.Machine Learning Attack Series: Backdooring Pickle Files, Johann Rehberger, 2022Hugging Face Pickle Scanning, Luc Georges, 2022The hidden dangers of loading open-source AI models (ARBITRARY CODE EXPLOIT!, Yannic Kilcher, 2022Secure Machine Learning at Scale with MLSecOps, Alejandro Saucedo, 2022Backdooring Pickles: A decade only made things worse, ColdwaterQ, DEFCON 2022Never a dill moment: Exploiting machine learning pickle files, Evan Sultanik, 2021 (tool:Fickling)Exploiting Python pickles, David Hamann, 2020Dangerous Pickles - malicious python serialization, Evan Sangaline, 2017Python Pickle Security Problems and Solutions, Travis Cunningham, 2015Arbitrary code execution with Python pickles, Stephen Checkoway, 2013Sour Pickles, A serialised exploitation guide in one part, Marco Slaviero, BlackHat USA 2011 (see also:doc,slides)