Malicious ML Model Detection by Learning Dynamic Behaviors

• URL: http://arxiv.org/abs/2604.19438v1
• Date: Tue, 21 Apr 2026 13:12:42 GMT
• Title: Malicious ML Model Detection by Learning Dynamic Behaviors
• Abstract summary: Malicious attacks can execute arbitrary code on trusted user environments, e.g., during model loading.<n>We propose a novel technique which detects malicious PTMs by learning the behavior of benign PTMs using dynamic analysis and machine learning (ML)<n>We evaluate DynaHug using over 25,000 benign and malicious PTMs from different sources including Hugging Face and MalHug.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Pre-trained machine learning models (PTMs) are commonly provided via Model Hubs (e.g., Hugging Face) in standard formats like Pickles to facilitate accessibility and reuse. However, this ML supply chain setting is susceptible to malicious attacks that are capable of executing arbitrary code on trusted user environments, e.g., during model loading. To detect malicious PTMs, state-of-the-art detectors (e.g., PickleScan) rely on rules, heuristics, or static analysis, but ignore runtime model behaviors. Consequently, they either miss malicious models due to under-approximation (blacklisting) or miscategorize benign models due to over-approximation (static analysis or whitelisting). To address this challenge, we propose a novel technique (DynaHug) which detects malicious PTMs by learning the behavior of benign PTMs using dynamic analysis and machine learning (ML). DynaHug trains an ML classifier (one-class SVM (OCSVM)) on the runtime behaviours of task-specific benign models. We evaluate DynaHug using over 25,000 benign and malicious PTMs from different sources including Hugging Face and MalHug. We also compare DynaHug to several state-of-the-art detectors including static, dynamic and LLM-based detectors. Results show that DynaHug is up to 44% more effective than existing baselines in terms of F1-score. Our ablation study demonstrates that our design decisions (dynamic analysis, OCSVM, clustering) contribute positively to DynaHug's effectiveness.

Related papers

• Von Mises-Fisher Mixture Model with Dynamic Shrinkage for Realistic Test-Time Transduction [29.23829287730805]
  Mixture of Von Mises-Fisher Models with Dynamic Shrinkage (MOON)<n>MOON is built upon a mixture of von Mises-Fisher distributions to model feature representations on the unit hypersphere.<n>It suppresses unreliable assignments and prevents harmful updates from outlier classes.
  arXiv  Detail & Related papers  (2026-07-17T11:08:08Z)
• Lifecycle-Aware Dynamic Analysis for Secure ML Model Execution [5.18451633489276]
  A growing reliance on pre-trained Machine Learning (ML) models has introduced new attack surfaces.<n>Recent vulnerabilities demonstrate that malicious behavior can be embedded within model artifacts, often bypassing existing defenses.<n>We propose a solution that focuses on the effects an attack has on the host system executing the model.
  arXiv  Detail & Related papers  (2026-06-17T12:49:22Z)
• Machine Learning-Based Detection of MCP Attacks [1.6034709235899625]
  The Model Context Protocol (MCP) is a new and emerging technology that extends the functionality of large language models.<n>Several studies have highlighted related security flaws, but MCP attack detection remains underexplored.<n>This study develops and evaluates a range of supervised machine learning approaches, including both traditional and deep-learning models.
  arXiv  Detail & Related papers  (2026-04-12T08:54:58Z)
• Reshaping Action Error Distributions for Reliable Vision-Language-Action Models [69.38615670891038]
  In robotic manipulation, vision-language-action (VLA) models have emerged as a promising paradigm for learning generalizable and scalable robot policies.<n>We focus on continuous-action VLA models and move beyond conventional MSE-based regression by reshaping action error distributions during training.<n>We evaluate our approaches across standard, few-shot, and noisy settings on multiple representative VLA architectures.
  arXiv  Detail & Related papers  (2026-02-04T05:37:09Z)
• Adversarially Robust and Interpretable Magecart Malware Detection [1.3266402517619371]
  Magecart skimming attacks have emerged as a significant threat to client-side security and user trust in online payment systems.<n>This paper addresses the challenge of achieving robust and explainable detection of Magecart attacks through a comparative study of various Machine Learning (ML) models with a real-world dataset.
  arXiv  Detail & Related papers  (2025-11-06T15:13:29Z)
• Model Utility Law: Evaluating LLMs beyond Performance through Mechanism Interpretable Metric [99.56567010306807]
  Large Language Models (LLMs) have become indispensable across academia, industry, and daily applications.<n>One core challenge of evaluation in the large language model (LLM) era is the generalization issue.<n>We propose Model Utilization Index (MUI), a mechanism interpretability enhanced metric that complements traditional performance scores.
  arXiv  Detail & Related papers  (2025-04-10T04:09:47Z)
• Predictable MDP Abstraction for Unsupervised Model-Based RL [93.91375268580806]
  We propose predictable MDP abstraction (PMA) Instead of training a predictive model on the original MDP, we train a model on a transformed MDP with a learned action space. We theoretically analyze PMA and empirically demonstrate that PMA leads to significant improvements over prior unsupervised model-based RL approaches.
  arXiv  Detail & Related papers  (2023-02-08T07:37:51Z)
• Model Monitoring and Robustness of In-Use Machine Learning Models: Quantifying Data Distribution Shifts Using Population Stability Index [2.578242050187029]
  We focus on a computer vision example related to autonomous driving and aim at detecting shifts that occur as a result of adding noise to images. We use the population stability index (PSI) as a measure of presence and intensity of shift and present results of our empirical experiments.
  arXiv  Detail & Related papers  (2023-02-01T22:06:31Z)
• Learning continuous models for continuous physics [94.42705784823997]
  We develop a test based on numerical analysis theory to validate machine learning models for science and engineering applications. Our results illustrate how principled numerical analysis methods can be coupled with existing ML training/testing methodologies to validate models for science and engineering applications.
  arXiv  Detail & Related papers  (2022-02-17T07:56:46Z)
• Which priors matter? Benchmarking models for learning latent dynamics [70.88999063639146]
  Several methods have proposed to integrate priors from classical mechanics into machine learning models. We take a sober look at the current capabilities of these models. We find that the use of continuous and time-reversible dynamics benefits models of all classes.
  arXiv  Detail & Related papers  (2021-11-09T23:48:21Z)
• Momentum Pseudo-Labeling for Semi-Supervised Speech Recognition [55.362258027878966]
  We present momentum pseudo-labeling (MPL) as a simple yet effective strategy for semi-supervised speech recognition. MPL consists of a pair of online and offline models that interact and learn from each other, inspired by the mean teacher method. The experimental results demonstrate that MPL effectively improves over the base model and is scalable to different semi-supervised scenarios.
  arXiv  Detail & Related papers  (2021-06-16T16:24:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.