Hugging Face model card supply chain manipulation
Date: 2025-01
Affected: Hugging Face Hub — 500K+ public models; any ML platform with self-reported model metadata; all downstream users who trust model card claims
Attack vector: rce
Category: research-demonstrated
Severity: Critical

Researchers from JFrog Security discovered that Hugging Face model cards — the metadata documents that describe model capabilities, limitations, and safety information — could be manipulated to execute arbitrary code when rendered in certain environments. Malicious actors uploaded models with crafted model cards containing embedded scripts that execute during model loading or card rendering. Additionally, model card metadata (claimed safety evaluations, benchmark scores, license information) was found to be entirely self-reported with no verification. Researchers demonstrated that a model claiming to be "safety-tested" and "bias-free" in its card could contain backdoored weights, and the Hugging Face platform had no mechanism to verify these claims. The attack combines supply chain code execution with metadata trust manipulation.

Impact: Supply chain code execution via model card rendering; false safety claims on model cards undermine trust in model provenance; no platform-level verification of claimed evaluations; applies to all model hubs (HF, TensorFlow Hub, Model Garden)

Mitigations:
Sandbox model card rendering — no script execution
Model provenance verification: cryptographic signing of model weights and metadata
Platform-verified evaluation badges (not self-reported)
Automated scanning of uploaded model artifacts for malicious payloads
Model card schema enforcement with verified claims vs self-reported claims

Architectural layers (MAESTRO):
label: Foundation Models
notes: Malicious model weights + metadata in foundation model supply chain
role: origin
label: Data Operations
notes: Unverified provenance claims propagate to downstream users
role: propagation
label: Deployment & Infrastructure
notes: Platform rendering of model cards without sandboxing
role: blind-spot
label: Security & Compliance
notes: No verification of self-reported safety claims
role: blind-spot