New Attack Technique 'Sleepy Pickle' Targets Machine Learning Models

Sleepy Pickle is a technique that abuses Python's pickle serialization used for ML models to embed payloads that execute on deserialization, allowing attackers to modify model weights, insert backdoors, exfiltrate data, or manipulate outputs; a persistence variant called Sticky Pickle can self-replicate and obfuscate payloads. Trail of Bits and others recommend avoiding pickle for distributing models, using trusted sources, signed commits, or safer formats such as SafeTensors.