Hugging Face and Wiz Research Partnership for AI Security

Hugging Face has partnered with Wiz, a cloud security company, to enhance the security of its platform and the broader AI/ML ecosystem. This collaboration focuses on proactive vulnerability management, securing cloud infrastructure, and addressing systemic risks associated with model formats like pickle.

Platform Security Enhancements via Wiz

Hugging Face has integrated Wiz into its operational workflow to maintain a secure cloud environment through two primary mechanisms:

  • Vulnerability Management: A continuous process used to identify and remediate security vulnerabilities across the platform.
  • Cloud Security Posture Management (CSPM): Tooling used to configure and monitor the cloud environment to ensure security settings remain intact.

According to Hugging Face, the "holistic view of Vulnerabilities" provided by Wiz is particularly valuable for managing resources across multiple Kubernetes (k8s) clusters, regions, and cloud providers. The company has further extended this tooling to automate the remediation of detected issues, specifically within Hugging Face Spaces.

Addressing Sandboxed Compute Vulnerabilities

As part of their joint research, Wiz's security team identified vulnerabilities in Hugging Face's sandboxed compute environments. These flaws allowed for the execution of arbitrary code via the use of pickle files. Hugging Face states that all issues related to this specific exploit have been resolved and that they continue to utilize Threat Detection and Incident Response processes to prevent future occurrences.

The Security Risks of Pickle Files

Pickle files are a significant source of security risk in the AI/ML community due to inherent flaws that allow for arbitrary code execution. Hugging Face has adopted a "middle ground" approach to managing these files rather than banning them entirely, balancing community utility with security.

To mitigate the risks associated with pickle, Hugging Face has implemented the following controls:

  • Automated Scanning: Developing and deploying tools to scan for vulnerabilities.
  • Security Labeling: Labeling models containing security vulnerabilities with clear warnings.
  • Documentation: Providing clear guides outlining the risks of using pickle files.
  • Safetensors Integration: Promoting and integrating Safetensors as a secure, first-class alternative to the pickle format.

Community Security Tools and Best Practices

In collaboration with other partners, Hugging Face has developed several tools to lower security risks for the entire AI community:

  • Picklescan: A tool built in partnership with Microsoft to scan for malicious pickle files.
  • Safetensors: A secure alternative to pickle files, which has been audited by Trail of Bits in collaboration with EuletherAI and Stability AI.
  • Scanning Services: Implementation of malware scanning and secrets scanning on the platform.
  • Bug Bounty Program: A formal program for researchers to report security vulnerabilities.

Recommended Best Practices for AI/ML Users

Security professionals and users are encouraged to adopt the following practices when working with open source models:

  • Avoid Pickle in Production: Do not use pickle files in production environments; use Safetensors instead.
  • Verify Sources: Only use models from trusted contributors and utilize commit signing.
  • Account Security: Enable Multi-Factor Authentication (MFA) on Hugging Face accounts.
  • Environment Isolation: Test models in virtualized, non-production development environments.
  • Standard Frameworks: Review the OWASP top 10 for general security controls.

Sources