{"id":"https://openalex.org/W7078426330","doi":"https://doi.org/10.48550/arxiv.2508.19774","title":"The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again","display_name":"The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again","publication_year":2025,"publication_date":"2025-08-27","ids":{"openalex":"https://openalex.org/W7078426330","doi":"https://doi.org/10.48550/arxiv.2508.19774"},"language":"en","primary_location":{"id":"doi:10.48550/arxiv.2508.19774","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2508.19774","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2508.19774","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Liu, Tong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Tong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Meng, Guozhu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Meng, Guozhu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Zhou, Peng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Peng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Deng, Zizhuang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Deng, Zizhuang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Yao, Shuaiyin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yao, Shuaiyin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"Chen, Kai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Kai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6550999879837036,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6550999879837036,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13067","display_name":"Geological Modeling and Analysis","score":0.02539999969303608,"subfield":{"id":"https://openalex.org/subfields/1906","display_name":"Geochemistry and Petrology"},"field":{"id":"https://openalex.org/fields/19","display_name":"Earth and Planetary Sciences"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14311","display_name":"Electrical and Electromagnetic Research","score":0.020999999716877937,"subfield":{"id":"https://openalex.org/subfields/3107","display_name":"Atomic and Molecular Physics, and Optics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.5390999913215637},{"id":"https://openalex.org/keywords/serialization","display_name":"Serialization","score":0.39489999413490295},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.3783000111579895},{"id":"https://openalex.org/keywords/supply-chain","display_name":"Supply chain","score":0.37310001254081726},{"id":"https://openalex.org/keywords/false-accusation","display_name":"False accusation","score":0.33959999680519104}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6252999901771545},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5899999737739563},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.5390999913215637},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.40799999237060547},{"id":"https://openalex.org/C52723943","wikidata":"https://www.wikidata.org/wiki/Q1127410","display_name":"Serialization","level":2,"score":0.39489999413490295},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3783000111579895},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.37310001254081726},{"id":"https://openalex.org/C59577422","wikidata":"https://www.wikidata.org/wiki/Q10265143","display_name":"False accusation","level":2,"score":0.33959999680519104},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.3068999946117401},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.29899999499320984},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.289900004863739},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2526000142097473}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2508.19774","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2508.19774","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2508.19774","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2508.19774","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Pickle":[0],"deserialization":[1],"vulnerabilities":[2],"have":[3,55,80],"persisted":[4],"throughout":[5],"Python's":[6],"history,":[7],"remaining":[8],"widely":[9],"recognized":[10],"yet":[11],"unresolved.":[12],"Due":[13],"to":[14,17,31,83,102,245],"its":[15,40],"ability":[16],"transparently":[18],"save":[19],"and":[20,67,99,124,138,183,234,250],"restore":[21],"complex":[22],"objects":[23],"into":[24],"byte":[25],"streams,":[26],"many":[27],"AI/ML":[28,162],"frameworks":[29],"continue":[30],"adopt":[32],"pickle":[33,65],"as":[34,52],"the":[35,44,61,91,95,110,115,147,196,213,226],"model":[36,46,72,117,122,133,148,156,228],"serialization":[37],"protocol":[38],"despite":[39],"inherent":[41],"risks.":[42],"As":[43],"open-source":[45],"ecosystem":[47],"grows,":[48],"model-sharing":[49],"platforms":[50],"such":[51],"Hugging":[53],"Face":[54],"attracted":[56],"massive":[57],"participation,":[58],"significantly":[59],"amplifying":[60],"real-world":[62,238],"risks":[63],"of":[64,90,114,165,189],"exploitation":[66],"opening":[68],"new":[69],"avenues":[70],"for":[71],"supply":[73],"chain":[74],"poisoning.":[75],"Although":[76],"several":[77],"state-of-the-art":[78],"scanners":[79],"been":[81],"developed":[82],"detect":[84],"poisoned":[85],"models,":[86],"their":[87],"incomplete":[88],"understanding":[89],"poisoning":[92,118,134,229],"surface":[93,119],"leaves":[94],"detection":[96],"logic":[97],"fragile":[98],"allows":[100],"attackers":[101],"bypass":[103,177,192,209,221],"them.":[104],"In":[105],"this":[106],"work,":[107],"we":[108,151,200,231],"present":[109],"first":[111],"systematic":[112],"disclosure":[113],"pickle-based":[116,132,155,227],"from":[120],"both":[121],"loading":[123,149,157],"risky":[125,197],"function":[126,198],"perspectives.":[127],"Our":[128],"research":[129],"demonstrates":[130],"how":[131],"can":[135,191],"remain":[136],"stealthy":[137],"highlights":[139],"critical":[140],"gaps":[141],"in":[142],"current":[143],"scanning":[144],"solutions.":[145],"On":[146,195],"surface,":[150,199,230],"identify":[152],"22":[153],"distinct":[154],"paths":[158],"across":[159],"five":[160],"foundational":[161],"frameworks,":[163],"19":[164],"which":[166,190],"are":[167],"entirely":[168],"missed":[169],"by":[170],"existing":[171],"scanners.":[172,194,239],"We":[173,240],"further":[174],"develop":[175],"a":[176,207,251],"technique":[178],"named":[179],"Exception-Oriented":[180],"Programming":[181],"(EOP)":[182],"discover":[184,201],"9":[185],"EOP":[186],"instances,":[187],"7":[188],"all":[193],"133":[202],"exploitable":[203],"gadgets,":[204],"achieving":[205],"almost":[206],"100%":[208],"rate.":[210,222],"Even":[211],"against":[212,237],"best-performing":[214],"scanner,":[215],"these":[216],"gadgets":[217],"maintain":[218],"an":[219],"89%":[220],"By":[223],"systematically":[224],"revealing":[225],"achieve":[232],"practical":[233],"robust":[235],"bypasses":[236],"responsibly":[241],"disclose":[242],"our":[243],"findings":[244],"corresponding":[246],"vendors,":[247],"receiving":[248],"acknowledgments":[249],"$6000":[252],"bug":[253],"bounty.":[254]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}