In a pickle: Why every pickle defense in machine learning is bypassed the same way

The machine learning (ML) ecosystem recently shipped a series of defenses against malicious model files. PyTorch restricted what its loader will deserialize. Keras added a safe mode that refuses to execute embedded code. Vendors built scanners to inspect model files at rest and reject the dangerous ones. But none of them held up to six documented CVE bypasses. These bypasses, often called “pickles,” let a malicious Python data file slip past security scanners undetected. And after the Sysdig Threat Research Team (TRT) pulled apart every public pickle bypass on record, a pattern emerged. Before we explore that pattern, let’s first understand what a pickle actually is and why machine learning (ML) is full of them. Then, we’ll analyze which model formats are most dangerous, what the Sydig TRT measured when we ran malicious model loads against two detection engines, and how you can best deploy and protect susceptible models in your environment. Pickle is a built-in Python capability for saving something in memory to file so you can load it back later exactly as it was. Many teams may be pickling and they don't even realize it. torch.save() or joblib are both pickle, and that hidden misunderstanding increases exposure and…