Speaker
Description
In Homer's Odyssey, the Greeks left a gift at the gates of Troy. It looked magnificent. It was a trap. Every day, developers do the same thing: download a model from Hugging Face, load it with torch.load(), and run it. The checkpoint looks like a gift. Sometimes, it is a trap.
I will open with a live demo: a small, innocent-looking model file that opens a reverse shell the moment it loads. No crash, no warning. This is not hypothetical. In 2024, JFrog found over a hundred malicious models on Hugging Face doing exactly this. In 2025, ReversingLabs discovered models using a technique called "nullifAI" to embed payloads in seemingly safe architectures.
The root cause: popular serialization formats like pickle allow arbitrary code execution during deserialization. A model file is not just weights. It is a program, and you are running it blind.
The fix now exists and it is open source. The OpenSSF Model Signing (OMS) specification, formalized in June 2025 and backed by Google, NVIDIA, and Red Hat, lets you sign model artifacts cryptographically and verify them before loading. It is a single pip install model-signing away. Under the hood, OMS uses Sigstore bundles wrapping in-toto attestation statements, the same trust infrastructure that secures container images. Major hubs including NVIDIA NGC and Google Kaggle are adopting it.
In the second demo, I will sign a model, tamper with it, and show verification catching the modification. I will also cover safer format alternatives like SafeTensors and ONNX that eliminate pickle entirely, and close with how you can contribute to the OpenSSF model-signing project on GitHub.
If you download models from the internet, this talk is for you.
Any other info we should know?
This is a technical talk with two live demonstrations that make the content memorable. The first demo shows a malicious model executing code on load. The second demo shows how model signing catches tampering. The audience will leave knowing how to sign their own models, verify models before loading them, and choose safer serialization formats. The talk is designed to be interactive during Q&A, and I expect strong audience engagement since every student who has ever downloaded a model from Hugging Face is directly affected by this problem.
Session author's bio
I'm Rahul Sharma, a Senior Software Engineer at Red Hat with over six years of experience building Python and Go systems for cloud-native infrastructure. I specialize in rule-driven diagnostics across Linux and OpenShift, AI model security, and multi-agent development workflows.
At the core of my work is Python. It is the language I use to connect infrastructure tooling, diagnostic engines, and AI-assisted workflows into production-ready systems. I'm deeply interested in deterministic, testable architectures and integrating LLM components into infrastructure software with strong evaluation and guardrails.
I believe the best talks come from production scars, not slide decks. Always open to connecting with fellow engineers and open source builders!
| Agree to Privacy Policy and Notice | I agree |
|---|---|
| Level of Difficulty | Beginner |
| Social Media | https://x.com/SRahul_ |
| In Person Attendance | Remote |
| Please confirm that there are included headshots of all speakers in their profiles | Yes |