Model Namespace Reuse Supply Chain Attack

Summary

Unit 42 researchers demonstrated an AI supply chain attack in which an attacker reclaims a deleted Hugging Face author namespace and publishes a malicious model under the same historical Author/ModelName identifier. Applications and model catalogs that retain unpinned references to that identifier may resolve and deploy the adversary-controlled replacement rather than the originally trusted artifact. The attack can affect deleted models and models whose ownership was transferred to a new Hugging Face author. In the ownership-transfer scenario, Hugging Face redirects requests for the old path to the new model location, allowing stale references to continue working. If the original author namespace is later deleted and reclaimed by an attacker, the attacker can recreate the old path and cause it to resolve to a malicious model instead of the legitimate redirected model. Unit 42 demonstrated this technique against Hugging Face-backed model catalogs in Google Vertex AI and Azure AI Foundry. The researchers embedded reverse-shell payloads in replacement models and obtained code execution in the deployed endpoint environments. They also identified reusable model references in open-source code repositories, documentation, default arguments, example notebooks, and downstream model registries, which could expose users who do not directly interact with Hugging Face. Target: Users of Hugging Face-backed model catalogs, code pipelines, and cloud integrations Actor: Unit 42 Researchers Procedure: 1. Unit 42 reviewed public Hugging Face-backed model catalogs, Hugging Face author pages, and open-source repositories to identify references to models whose original author namespace had been deleted and was available for registration. They identified stale references in cloud catalogs, source code, documentation, default arguments, and example notebooks. 2. Unit 42 registered a Hugging Face organization using an abandoned namespace associated with a previously trusted model path. The original owner's account was not compromised. 3. By recreating the namespace, Unit 42 made the malicious artifact appear to be the formerly trusted model. For transferred models, reclaiming the old namespace displaced the legacy redirect to the legitimate model's new location. 4. Unit 42 prepared attacker-controlled model artifacts containing a payload that initiated a reverse shell when deployed or loaded. 5. Unit 42 uploaded the malicious model under the reclaimed namespace using the original Author/ModelName identifier. 6. A cloud model catalog, application, or deployment pipeline resolved its stale name-only model reference to the attacker-controlled replacement model. Unit 42 demonstrated this through Vertex AI and Azure AI Foundry deployments. 7. When a user or service deployed the malicious model, loading or deployment executed the embedded payload in the model endpoint environment. 8. The payload established a reverse shell from the deployed endpoint to researcher-controlled infrastructure.

Deployers

• Users of Hugging Face-backed model catalogs, code pipelines, and cloud integrations

Tags

• MITRE ATLAS
• AML.CS0065