Security researchers at ReversingLabs have identified two suspicious machine learning models on Hugging Face that employed a unique “broken” pickle files method to bypass security measures. The discovered models, hosted under repositories glockr1/ballr7 and who-r-u0000/0000000000000000000000000000000000000, contained malicious Python code designed to create reverse shell connections to specific IP addresses.

Dubbed “nullifAI,” this technique exploits vulnerabilities in how pickle files are processed during ML model distribution. The malicious models, stored in PyTorch format, used 7z compression instead of the standard ZIP format, enabling them to evade detection by Hugging Face’s security tool, Picklescan.

The key vulnerability lies in the sequential nature of pickle file deserialization. Although the files were intentionally corrupted to break during decompilation, the malicious code positioned at the beginning of the Pickle stream could still execute before the corruption point was reached. This discrepancy between Picklescan’s detection method and actual deserialization behavior allowed the malicious code to operate despite generating error messages.

While these instances appear to be proof-of-concept rather than active supply chain attacks, they highlight ongoing security concerns with pickle serialization in ML model distribution. In response, Picklescan has been updated to address this vulnerability and prevent similar exploitation attempts.