Sleepy Pickle: a new attack technique against machine learning models

Updated August 2026. The pickle format is still the weak point, and defensive research has since caught up. Current mitigations and the newer academic work are covered at the end of this article.

A new attack method, dubbed "Sleepy Pickle," has recently come to light, highlighting the security risks associated with the widely used Pickle format for packaging and distributing machine learning (ML) models. This innovative exploitation technique, as reported by the cybersecurity firm Trail of Bits, weaponizes the Pickle format to corrupt the ML model itself, posing a severe supply chain risk to downstream customers of organizations utilizing these models.

The Sleepy Pickle Approach

Sleepy Pickle is a stealthy and novel attack technique that directly targets the ML model, rather than the underlying system. The attack works by injecting a malicious payload into a Pickle file using open-source tools like Fickling. This compromised file can then be delivered to a target host through various methods, including adversary-in-the-middle (AitM) attacks, phishing campaigns, supply chain compromises, or by exploiting system vulnerabilities.

Payload Execution and Model Tampering

Once the compromised Pickle file is deserialized on the victim's system, the payload executes and modifies the contained ML model in-place. This modification can involve inserting backdoors, controlling the model's outputs, or tampering with the data processed by the model before returning it to the user. The payload can manipulate the model's behaviour by altering its weights or tampering with the input and output data processed by the model.

Potential Attack Scenarios

In a hypothetical attack scenario, Sleepy Pickle could be used to generate harmful or misleading outputs, potentially leading to disastrous consequences for user safety, such as recommending dangerous substances as cures for illnesses. Additionally, the attack could be used to steal user data under specific conditions or indirectly attack users by generating manipulated summaries of news articles with links to phishing pages.

Sticky Pickle: Achieving Persistence

Trail of Bits has also demonstrated a variant of Sleepy Pickle called "Sticky Pickle," which incorporates a self-replicating mechanism to propagate the malicious payload into successive versions of the compromised model. This variant also employs obfuscation techniques to disguise the malicious code, making it harder to detect by Pickle file scanners.

Mitigating the Threat

To mitigate the risks posed by Sleepy Pickle and other supply chain attacks, it is recommended to avoid using Pickle files for distributing serialized ML models. Instead, organizations should rely on models from trusted sources and use safer file formats like SafeTensors.

Conclusion

Sleepy Pickle demonstrates that advanced model-level attacks can exploit lower-level supply chain weaknesses by targeting the connections between underlying software components and the final application. This highlights the critical need for robust security measures to protect the integrity of machine learning models and ensure their safe deployment and use.

Update, August 2026: Defensive Research Has Caught Up

Pickle deserialization now has dedicated defensive research behind it. PickleBall, presented at the ACM CCS 2025 conference, sets out a secure deserialization approach for pickle-based machine learning models, with an extended report published as arXiv:2508.15987. This matters because the standard advice, which is to avoid untrusted pickle files, is difficult to follow in practice when a public model hub is the distribution channel. A defence that operates at load time addresses the problem where it actually occurs.

The underlying format risk has not changed. Trail of Bits published the original two-part analysis on June 11, 2024, and its practical recommendation still holds: prefer SafeTensors, which stores tensor data only and provides no mechanism for executing Python objects when a model loads. Teams auditing their model supply chain should also read our coverage of malicious ML models found on Hugging Face, the broader catalog of AI attack techniques, and how LLMOps practice handles model provenance.

Source : The Hacker News