Hugging Face Packages Weaponized With a Single File Tweak - Dark Reading

A report from Dark Reading describes a security vulnerability in Hugging Face AI models where a tokenizer file can be manipulated to hijack outputs and exfiltrate data. An attacker could upload a poisoned model to a public repository, potentially affecting users who download and use the model.

The manipulation involves a single file tweak, enabling the attacker to control model outputs and exfiltrate data without the victim's knowledge. The report indicates that the vulnerability lies in the tokenizer file, which is part of the model package. Because tokenizer files are often overlooked in security audits, the attack can be difficult to detect.

The findings highlight security concerns in the ML supply chain, as public model repositories like Hugging Face are widely used. The report suggests that such vulnerabilities could be exploited by malicious actors to compromise systems that rely on pre-trained models. The manipulation can be performed without altering model weights, making it a stealthy vector for attack.