'Sleepy Pickle' Exploit Subtly Poisons ML Models

Researchers disclosed a method dubbed “Sleepy Pickle” that weaponizes Python Pickle serialization to embed malicious bytecode inside serialized ML models; when a poisoned .pkl model is deserialized, it can execute arbitrary Python payloads to manipulate model outputs, insert backdoors, exfiltrate data, or deliver other stealthy attacks. The report demonstrates tooling (Flicking) and practical impacts, and recommends mitigations such as using safetensors, sandboxed conversion, and stronger trust/segregation controls to prevent supply-chain and deserialization-based compromises.