{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:03:16Z","timestamp":1782975796687,"version":"3.54.5"},"reference-count":72,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00123","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"272-289","source":"Crossref","is-referenced-by-count":0,"title":["On the (In)Security of Loading Machine Learning Models"],"prefix":"10.1109","author":[{"given":"Gabriele","family":"Digregorio","sequence":"first","affiliation":[{"name":"Politecnico di Milano,Milan,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marco","family":"Di Gennaro","sequence":"additional","affiliation":[{"name":"Politecnico di Milano,Milan,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stefano","family":"Zanero","sequence":"additional","affiliation":[{"name":"Politecnico di Milano,Milan,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stefano","family":"Longari","sequence":"additional","affiliation":[{"name":"Politecnico di Milano,Milan,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michele","family":"Carminati","sequence":"additional","affiliation":[{"name":"Politecnico di Milano,Milan,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"08","author":"Face Inc","year":"2025","journal-title":"Hugging Face Hub Documentation"},{"key":"ref2","first-page":"08","author":"Inc","year":"2025","journal-title":"Kaggle Models"},{"key":"ref3","author":"Watson","year":"2024","journal-title":"KerasHubtle"},{"key":"ref4","first-page":"2025","year":"2025","journal-title":"Google Research Brain Team, \u201cTensorFlow Hub: Reusable Machine Learning Modules"},{"key":"ref5","first-page":"08","year":"2025","journal-title":"PyTorch Foundation, \u201c PyTorch Hub"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.23055"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"ref8","first-page":"21","article-title":"SoK: Taxonomy of Attacks on Open-Source Software Supply Chains","volume-title":"in 44th IEEE Symposium on Security and Privacy SP","author":"Ladisa"},{"key":"ref9","first-page":"105","article-title":"An Empirical Study of Artifacts and Security Risks in the Pre-trained Model Supply Chain","volume-title":"in Proceedings of the 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses, SCORED 2022, Los Angeles, CA, USA, 7November 2022","author":"Jiang"},{"key":"ref10","article-title":"A Large-Scale Exploit Instrumentation Study of AIML Supply Chain Attacks in Hugging Face Models","volume":"abs2410.04490","author":"Casey","year":"2024","journal-title":"arXiv preprint"},{"key":"ref11","article-title":"SoK: Understanding Vulnerabilities in the Large Language Model Supply Chain","author":"Wang","year":"2025","journal-title":"CoRR"},{"key":"ref12","article-title":"Position: Machine learning models have a supply chain problem","volume-title":"in Forty-second International Conference on Machine Learning Position Paper Track","author":"Meiklejohn","year":"2025"},{"key":"ref13","article-title":"MalModel: Hiding Malicious Payload in Mobile Deep Learning Models with Black-box Backdoor Attack","volume":"abs2401.02659","author":"Hua","year":"2024","journal-title":"arXiv preprint"},{"key":"ref14","first-page":"1","article-title":"EvilModel: Hiding Malware Inside of Neural Network Models","volume-title":"in IEEE Symposium on Computers and Communications ISCC, Athens, Greece","author":"Wang"},{"key":"ref15","doi-asserted-by":"crossref","first-page":"102807","DOI":"10.1016\/j.cose.2022.102807","article-title":"EvilModel 2.0: Bringing Neural Network Models into Malware Attacks","volume":"120","author":"Wang","year":"2022","journal-title":"Computers & Security"},{"key":"ref16","first-page":"2087","article-title":"Models Are Codes: Towards Measuring Malicious Code Poisoning Attacks on Pre-trained Model Hubs","volume-title":"in Proceedings of the 39th IEEEACM International Conference on Automated Software Engineering, ASE 2024, Sacramento, CA, USA, October 27 - November 1, 2024","author":"Zhao"},{"issue":"6","key":"ref17","doi-asserted-by":"crossref","first-page":"155","DOI":"10.1007\/s10664-025-10711-4","article-title":"I see models being a whole other thing\u201d: an empirical study of pre-trained model naming conventions and a tool for enhancing naming consistency","volume":"30","author":"Jiang","year":"2025","journal-title":"Empirical Software Engineering"},{"key":"ref18","first-page":"2463","article-title":"An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registry","volume-title":"in 45th IEEEACM International Conference on Software Engineering ICSE, Melbourne, Australia","author":"Jiang"},{"key":"ref19","first-page":"13","article-title":"What do we know about Hugging Face? A systematic literature review and quantitative validation of qualitative claims","volume-title":"in Proceedings of the 18th ACMIEEE International Symposium on Empirical Software Engineering and Measurement, ESEM 2024, Barcelona, Spain, October 24\u201325, 2024","author":"Jones"},{"key":"ref20","first-page":"486","article-title":"My Model is Malware to You: Transforming AI Models into Malware by Abusing TensorFlow APIs","volume-title":"in IEEE Symposium on Security and Privacy, SP 2025, San Francisco, CA, USA, May 12\u2013 2025","author":"Zhu","year":"2025"},{"key":"ref21","first-page":"08","article-title":"Loading Models, Launching Shells: Abusing AI File Formats for Code Execution","volume-title":"Presentation at the DEF CON 33 Hacking Conference","author":"Parzian"},{"key":"ref22","first-page":"07","year":"2025","journal-title":"Keras developers, \u201cWholemodelsaving&loading-Keras"},{"key":"ref23","first-page":"2025","year":"2025","journal-title":"CVE Program CVE-2025\u20131550"},{"key":"ref24","first-page":"08","year":"2025","journal-title":"CVE-2025\u20138747"},{"key":"ref25","author":"Chollet","year":"2015","journal-title":"Keras"},{"key":"ref26","first-page":"265","article-title":"TensorFlow: a system for Large-Scale machine learning","author":"Abadi","year":"2016","journal-title":"in 12th USENIX symposium on operating systems design and implementation (OSDI 16)"},{"key":"ref27","first-page":"08","author":"Developers","year":"2024","journal-title":"SavedModel format guide - TensorFlow documentation"},{"key":"ref28","first-page":"08","author":"Developers","year":"2024","journal-title":"Training checkpoints - TensorFlow documentation"},{"key":"ref29","first-page":"07","article-title":"PyTorch Foundation","year":"2025","journal-title":"PyTorch Foundation"},{"key":"ref30","first-page":"2025","article-title":"PyTorch developers","year":"2025","journal-title":"Save and Load the Model - PyTorch Tutorials 2.7.0+cu126 documentation"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1201.0490"},{"key":"ref32","first-page":"07","article-title":"10. Model persistence - scikit-learn 1.7.1 documentation","year":"2025","journal-title":"scikit-learn developers"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.32614\/cran.package.xgboost"},{"key":"ref34","first-page":"08","year":"2025","journal-title":"XGBoost developers, \u201cIntroduction to ModelIO - XGBoost Tutorials 3.1.0-dev documentation"},{"key":"ref35","author":"Mooney","year":"2022","journal-title":"2022 Kaggle Machine Learning & Data Science Survey, kaggle"},{"key":"ref36","first-page":"08","year":"2024","journal-title":"JetBrains, \u201cPython Developers Survey 2024"},{"key":"ref37","first-page":"08","year":"2025","journal-title":"Keras developers, \u201cWeights-only saving & loading - Keras"},{"key":"ref38","first-page":"08","article-title":"Save and load Keras models - TensorFlow documentation","year":"2024","journal-title":"TensorFlow Developers"},{"key":"ref39","first-page":"07","year":"2025","journal-title":"PyTorch developers, \u201cSerialization semantics - PyTorch 2.7 documentation"},{"key":"ref40","first-page":"08","article-title":"pickle - Python object serialization","year":"2025","journal-title":"Python Software Foundation"},{"key":"ref41","first-page":"07","author":"Jalali","year":"2022","journal-title":"Introducing Skops"},{"key":"ref42","journal-title":"ONNX developers, \u201cONNX"},{"key":"ref43","first-page":"07","year":"2025","journal-title":"skops developers, \u201cSecure persistence with skops - skops 0.12 documentation"},{"key":"ref44","first-page":"08","year":"2025","journal-title":"XGBoost developers, \u201cPythonAPI Reference - xgboost 3.0.3 documentation"},{"key":"ref45","first-page":"2025","author":"Face Inc","year":"2025","journal-title":"Security - Hugging Face Hub Documentation"},{"key":"ref46","first-page":"08","article-title":"ClamAV: Open-Source Antivirus Toolkit","author":"Talos","year":"2025","journal-title":"ClamAV Team"},{"key":"ref47","first-page":"08","author":"Protect","year":"2025","journal-title":"Protect - The Platform for AI Security"},{"key":"ref48","first-page":"08","article-title":"Software Supply Chain Solutions for DevOps and Security - JFrog","year":"2025","journal-title":"JFrog Ltd"},{"key":"ref49","first-page":"08","author":"Foundation","year":"2025","journal-title":"PyTorch Hub - Documentation"},{"key":"ref50","first-page":"08","author":"Morgan","year":"2025","journal-title":"4M Models Scanned: Protect AI + Hugging Face 6 Months In"},{"key":"ref51","first-page":"08","article-title":"TensorFlow Security Policy","year":"2025","journal-title":"TensorFlow Security Team"},{"key":"ref52","first-page":"08","article-title":"Is TensorFlow Keras \u201cSafe Mode","author":"Polkovnichenko","year":"2025","journal-title":"Actually Safe? Bypassing safe_mode Mitigation to Achieve Arbitrary Code Execution"},{"key":"ref53","first-page":"09","article-title":"CVE-2025 9906","year":"2025","journal-title":"CVE Program"},{"key":"ref54","article-title":"Google Security Team, \u201cPrivate Communication","year":"2025","journal-title":"regarding the disclosure of Keras vulnerabilities"},{"key":"ref55","first-page":"09","article-title":"CVE-2025 9905","year":"2025","journal-title":"CVE Program"},{"key":"ref56","first-page":"07","year":"2025","journal-title":"CVE-2025 54413"},{"key":"ref57","first-page":"07","year":"2025","journal-title":"CVE-2025 54412"},{"key":"ref58","first-page":"07","year":"2025","journal-title":"skops developers, \u201cModel Cards for scikit-learn - skops 0.11 documentation"},{"key":"ref59","first-page":"08","article-title":"CVE-2025 54886","year":"2025","journal-title":"CVE Program"},{"key":"ref60","first-page":"08","article-title":"Guardian - AI Model Security with Zero Compromises","year":"2025","journal-title":"Protect AI"},{"key":"ref61","first-page":"08","article-title":"Understanding Model Threats","year":"2025","journal-title":"ProtectAI"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.2307\/3001968"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1186\/s13673-018-0125-x"},{"key":"ref64","first-page":"4679","article-title":"A Research Framework and Initial Study of Browser Security for the Visually Impaired,\u201d in 32nd USENIX Security Symposium (USENIX Security 23)","volume-title":"USENIX Association","author":"Lau"},{"key":"ref65","volume":"11","author":"Narsil","year":"2022","journal-title":"safetensors"},{"key":"ref66","first-page":"08","article-title":"CVE-2024 3660","year":"2025","journal-title":"CVE Program"},{"key":"ref67","author":"Havrilla","year":"2025","journal-title":"VU\\#253266 - Keras 2 Lambda Layers Allow Arbitrary Code Injection in TensorFlow Models last Revised"},{"key":"ref68","first-page":"08","article-title":"CVE-2021 37678","year":"2025","journal-title":"CVE Program"},{"key":"ref69","year":"2025","journal-title":"Fran\u00e7ois CholletDisallow pickle loading in npz files gitHub commit"},{"key":"ref70","first-page":"08","year":"2025","journal-title":"huntr Malicious Keras Model Leads to RCEe06-a03e-deb9ff2aa8be"},{"key":"ref71","first-page":"08","author":"Program","year":"2025","journal-title":"CVE-2024 37065"},{"key":"ref72","first-page":"2024","article-title":"Skops Vulnerability Report","author":"Schulz","year":"2024"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573394.pdf?arnumber=11573394","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:34:45Z","timestamp":1782970485000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573394\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":72,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00123","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}