ml-security

Disabling SGLang's direct Pickle transport changed the envelope and left the decoder in place. How both internal receive modes reached Pickle, and how a reachable internal receiver turned that into code execution in a real two-GPU service.

A scanner finds the services. The real shape of an AI estate lives in the hidden connections carrying credentials, trust, and data between them.

The model is one process. Around it sits the infrastructure that serves it, tracks it, stores its data, and wires it into everything else. This is a map of the services and seams that make up a modern model estate.

A from_pretrained() call is a download, a parse, and an execution decision wrapped in one convenient API. A reviewable workflow: pin the revision, approve the whole snapshot, read scan results literally, make the first load disposable, and promote the exact object you tested.

A model file can influence a great deal of computation without being executable code. On the difference between an executable serialization format and a tensor container, and why an out-of-bounds read in MLX's GGUF loader was worth fixing even after it was declined as a security issue.

Loading a model from a hub means running a binary parser on a file a stranger gave you. This is the map for Crucible: what the attack surface is, why a format-aware fuzzer beats a dumb one on it, and how a seed file becomes a filed advisory.

A structure-aware fuzzer found a small ONNX memory-safety bug, GitHub Copilot helped patch it upstream, and the public issue-to-merge loop closed the same afternoon.

SafeTensors did not survive fuzzing by luck. It survived because the format puts validation before allocation, keeps code out of the file, and treats model loading as an input-parsing problem.

Post-quantum signatures are entering supply-chain infrastructure. Any ML artifact signing profile that adopts ML-DSA should get one deployment detail right before it ships: randomized mode opens a 256-bit hidden command channel that no deployed verifier can inspect.

Two RAG systems with the same headline injection rate can need opposite defenses. Why a single number isn't enough, and what to report instead.

An ML attack is the composition of three things: a channel that carries information, a decoder that reads the channel, and a substrate that runs the decoder. Naming the shape changes how you think about both offense and defense.