Model hijacking

Model hijacking is used to tamper with a model to achieve parasitic functionality, which is different activity from what the model was designed for. Some worst-case scenarios would be tampering with the model to act as a remote access Trojan (RAT), communicating with a command and control (C2) server, or performing crypto mining.

To avoid being detected, the attackers will do this in parallel with the model’s primary function. There are two approaches to achieving this.

Trojan horse code injection

This is similar to the Trojan horses we have already discussed, but the injected code does not interfere with the integrity of the model’s predictions. Instead, it uses its own protocol to supply data that signal the execution of different functionality. This can vary from stealing data to communicating with external services.

We have an example in the book’s source code that demonstrates how to exploit pickle serialization so that for a given...