Model Serialization (e00f1c63-f2e5-5e37-bac9-b071965df2a1)
Models are serialized and transferred between systems for deployment, a stage vulnerable to model serialization attacks. Models are often serialized for storage, sharing, or deployment, using formats like pickle, joblib, ONNX, or TensorFlow SavedModel. However, many serialization formats can embed executable code or unsafe object structures.
If an attacker tampers with a serialized model artifact and it is later deserialized without validation, they may achieve: * Remote Code Execution (RCE) during deserialization. * Privilege escalation or lateral movement inside the deployment environment. * Tampering with model behavior (e.g., inserting a backdoor or triggering silent failures).
These risks are especially severe when models are downloaded from untrusted sources, integrated via ML pipelines, or auto-loaded during CI/CD processes.
Threat-modeling question: Could unsafe deserialization of model artifacts lead to code execution or system compromise?