HuggingFace 上的恶意模型 (AML.CS0031)

一句话通俗理解

模型文件里藏着反向 shell——「下载即上线」，HuggingFace 变成恶意软件分发站。

ReversingLabs 研究者在 HuggingFace 模型仓库发现了内嵌恶意软件的模型：利用 pickle 序列化格式在加载时执行代码的能力，模型文件被植入反向 shell 等载荷。下载并加载这些模型的用户会直接交出系统控制权。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0031 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

嵌入恶意软件 (AML.T0018.002)

The adversary embedded malware into an AI model stored in a pickle file. The malware was designed to execute when the model is loaded by a user.

ReversingLabs found two instances of this on Hugging Face during their research.

In both instances observed by the ReversingLab, the malicious models did not make any attempt to mimic a popular legitimate model.

破坏 AI 模型 (AML.T0076)

The adversary evaded detection by Picklescan, which Hugging Face uses to flag malicious models. This occurred because the model could not be fully deserialized.

In their analysis, the ReversingLabs researchers found that the malicious payload was still executed.

AI 供应链入侵 (AML.T0010)

Because the models were successfully uploaded to Hugging Face, a user relying on this model repository would have their supply chain compromised.

不安全 AI 制品 (AML.T0011.000)

If a user loaded the malicious model, the adversary’s malicious payload is executed.

网络通信信道 (AML.T0072)

The malicious payload was a reverse shell set to connect to a hardcoded IP address.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0