Unveiling the Perils of the TorchScript Engine in PyTorch
Discloses multiple memory corruption and deserialization vulnerabilities in PyTorch's TorchScript JIT engine that allow arbitrary remote code execution via malicious AI models.
Summary
PyTorch TorchScript and JIT Execution Engine
PyTorch TorchScript allows machine learning models to be serialized into standalone C++ runtimes for high-performance production inference across cloud servers and edge devices.
Analyzing the TorchScript Intermediate Representation
Ji'an Zhou and Lishuo Song audit the TorchScript JIT compiler, bytecode interpreter, and model deserialization routines, uncovering critical memory corruption and type confusion flaws.
Remote Code Execution via Weaponized Models
Crafting malicious model files targeting TorchScript parser vulnerabilities allows attackers to execute arbitrary code on cloud inference servers upon loading the model, bypassing Python sandbox restrictions.
Securing Machine Learning Model Pipelines
Remediating TorchScript vulnerabilities requires ML developers to treat untrusted model weights as untrusted binaries, enforce strict deserialization schemas, and run inference within isolated containers.
Related talks
Main Stage·34 min
Ji'an Zhou · Ying Zhu · ZiYang Li
Reveals critical architectural and deserialization vulnerabilities across Apache Kafka client and server implementations, enabling remote code execution.
Main Stage·39 min
Anna Antonenko
Demonstrates remote code execution across audio software and operating system synthesis engines by weaponizing malformed MIDI protocol messages.
Main Stage·41 min
Michael Gorelik · Arnold Osipov
Technical breakdown and exploitation of CVE-2024-30103, allowing zero-click and one-click remote code execution via Microsoft Outlook.