ModelScan - Protection Against Model Serialization Attacks, (Mon, Feb 17th)

This report demonstrates model serialization attacks using Python Pickle with PyTorch, showing that loading a malicious serialized model can execute arbitrary code (e.g., reading Google Cloud credentials). The author modifies a Protect AI ModelScan notebook to inject a command that exfiltrates local credentials, shows the unsafe model executing the command and producing predictions, and demonstrates ModelScan detecting the unsafe 'system' operator; the piece recommends scanning models throughout development and CI/CD to mitigate such supply-chain and serialization risks.