Evidence · DiggingBeagle record
DITTO context-aware Pickle scanner detects malicious model artifact deserialization
Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-014. Benchmark accuracy not general guarantee; Pickle safety does not cover weight-encoded backdoors.
- Source role
- primary disclosure
Evidence record
Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-014. Benchmark accuracy not general guarantee; Pickle safety does not cover weight-encoded backdoors.
Claim-level citations (3)
- supportsDITTO evaluates context-aware scanning of serialized model artifacts: The authors report that 9.3% of more than 10,000 surveyed popular Hugging Face repositories used Pickle serialization; the percentage is not a malware-infection rate.
Abstract, repository prevalence
- supportsDITTO evaluates context-aware scanning of serialized model artifacts: On PickleBench of 959 benign and 92 malicious examples, the researchers report a 0% false-negative rate, 0.7% false-positive rate and 0.966 F1 for DITTO.
Abstract, PickleBench results
- supportsDITTO evaluates context-aware scanning of serialized model artifacts: DITTO emulates Pickle virtual-machine state transitions and uses context-aware analysis, including extension-registry patterns, rather than flagging unsafe opcodes in isolation.
Abstract, DITTO method and PickleBench