Stories
Slash Boxes
Comments

SoylentNews is people

HuggingFace AI Exposing Multiple Backdoors to Users Machines

posted by janrinok on Saturday March 02 2024, @07:16PM   Printer-friendly
from the no-sec-in-ai dept.

bmimatt writes:

https://www.bleepingcomputer.com/news/security/malicious-ai-models-on-hugging-face-backdoor-users-machines/

At least 100 instances of malicious AI ML models were found on the Hugging Face platform, some of which can execute code on the victim's machine, giving attackers a persistent backdoor.

Hugging Face is a tech firm engaged in artificial intelligence (AI), natural language processing (NLP), and machine learning (ML), providing a platform where communities can collaborate and share models, datasets, and complete applications.

JFrog's security team found that roughly a hundred models hosted on the platform feature malicious functionality, posing a significant risk of data breaches and espionage attacks.

This happens despite Hugging Face's security measures, including malware, pickle, and secrets scanning, and scrutinizing the models' functionality to discover behaviors like unsafe deserialization.

[...] The analysts deployed a HoneyPot to attract and analyze the activity to determine the operators' real intentions but were unable to capture any commands during the period of the established connectivity (in one day).

Original Submission

 
This discussion was created by janrinok (52) for logged-in users only, but now has been archived. No new comments can be posted.
HuggingFace AI Exposing Multiple Backdoors to Users Machines | Log In/Create an Account | Top | 9 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by Freeman on Monday March 04 2024, @07:51PM (2 children)

    by Freeman (732) on Monday March 04 2024, @07:51PM (#1347343) Journal

    It's called "artificial" intelligence for a reason. It's certainly as smart as a Smart TV or a smartphone.

    --
    Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 2) by Freeman on Monday March 04 2024, @07:57PM

    by Freeman (732) on Monday March 04 2024, @07:57PM (#1347344) Journal

    Though thinking on the term "smart device" I'm lead to remember a show called "Get Smart".

    --
    Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"

  • (Score: 2) by maxwell demon on Tuesday March 05 2024, @08:02PM

    by maxwell demon (1608) on Tuesday March 05 2024, @08:02PM (#1347497) Journal

    You seemingly didn't get my comment. Hint: The CIA is not named after its IQ.

    --
    The Tao of math: The numbers you can count are not the real numbers.