模型命名空间复用供应链攻击 (AML.CS0065)

一句话通俗理解

作者删号跑路，攻击者抢注同名——你下载的「同一个模型」已经换了灵魂。

维度	内容
案例类型	演练 / 安全研究
发生时间	2025-09-03
攻击者	Unit 42 Researchers
受害目标	Users of Hugging Face-backed model catalogs, code pipelines, and cloud integrations

Unit 42 研究者演示了 HuggingFace 命名空间复用攻击：攻击者回收已删除的作者命名空间，以相同历史名称发布恶意模型——依赖该名称的下游用户与 CI 管道会无感拉取投毒模型，供应链信任基于「名字」的脆弱性暴露无遗。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0065 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

搜索开放网站/域名 (AML.T0095)

Unit 42 reviewed public Hugging Face-backed model catalogs, Hugging Face author pages, and open-source repositories to identify references to models whose original author namespace had been deleted and was available for registration. They identified stale references in cloud catalogs, source code, documentation, default arguments, and example notebooks.

建立账户 (AML.T0021)

Unit 42 registered a Hugging Face organization using an abandoned namespace associated with a previously trusted model path. The original owner’s account was not compromised.

伪装 (AML.T0074)

By recreating the namespace, Unit 42 made the malicious artifact appear to be the formerly trusted model. For transferred models, reclaiming the old namespace displaced the legacy redirect to the legitimate model’s new location.

嵌入恶意软件 (AML.T0018.002)

Unit 42 prepared attacker-controlled model artifacts containing a payload that initiated a reverse shell when deployed or loaded.

模型 (AML.T0115.001)

Unit 42 uploaded the malicious model under the reclaimed namespace using the original Author/ModelName identifier.

模型 (AML.T0010.003)

A cloud model catalog, application, or deployment pipeline resolved its stale name-only model reference to the attacker-controlled replacement model. Unit 42 demonstrated this through Vertex AI and Azure AI Foundry deployments.

不安全 AI 制品 (AML.T0011.000)

When a user or service deployed the malicious model, loading or deployment executed the embedded payload in the model endpoint environment.

网络通信信道 (AML.T0072)

The payload established a reverse shell from the deployed endpoint to researcher-controlled infrastructure.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0