Lifecycle-Aware Dynamic Analysis for Secure ML Model Execution

• URL: http://arxiv.org/abs/2606.19023v1
• Date: Wed, 17 Jun 2026 12:49:22 GMT
• Title: Lifecycle-Aware Dynamic Analysis for Secure ML Model Execution
• Abstract summary: A growing reliance on pre-trained Machine Learning (ML) models has introduced new attack surfaces.<n>Recent vulnerabilities demonstrate that malicious behavior can be embedded within model artifacts, often bypassing existing defenses.<n>We propose a solution that focuses on the effects an attack has on the host system executing the model.
• Score: 5.18451633489276
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The growing reliance on pre-trained Machine Learning (ML) models has introduced new attack surfaces. Recent vulnerabilities demonstrate that malicious behavior can be embedded within model artifacts, often bypassing existing defenses. Current model-scanning solutions primarily rely on static, format-specific rules or known attack signatures, which limit their ability to generalize across frameworks and to detect novel exploitation paths. In contrast, we propose a solution that focuses on the effects an attack has on the host system executing the model and builds on foundational intuitions about ML model execution. In particular, we observe that ML models operate within well-defined lifecycle phases and that, within each phase, interactions with the host system are highly structured and predictable. We translate these intuitions into Moat, a dynamic lifecycle-aware approach for securing ML model execution, and instantiate this design in Re-Moat, our reference implementation. We evaluate Re-Moat across multiple ML frameworks using 77,974 real-world model artifacts from the Hugging Face Hub, 31 Proofs-of-Concept (PoCs) from CVEs, and 334 models from a state-of-the-art dataset, and compare it against state-of-the-art model-scanning solutions. Our results show that our approach detects all evaluated attack classes while maintaining a close-to-zero false-positive rate, validating our intuitions and motivating dynamic analysis for securing ML model execution.

Related papers

• Malicious ML Model Detection by Learning Dynamic Behaviors [0.0]
  Malicious attacks can execute arbitrary code on trusted user environments, e.g., during model loading.<n>We propose a novel technique which detects malicious PTMs by learning the behavior of benign PTMs using dynamic analysis and machine learning (ML)<n>We evaluate DynaHug using over 25,000 benign and malicious PTMs from different sources including Hugging Face and MalHug.
  arXiv  Detail & Related papers  (2026-04-21T13:12:42Z)
• Reshaping Action Error Distributions for Reliable Vision-Language-Action Models [69.38615670891038]
  In robotic manipulation, vision-language-action (VLA) models have emerged as a promising paradigm for learning generalizable and scalable robot policies.<n>We focus on continuous-action VLA models and move beyond conventional MSE-based regression by reshaping action error distributions during training.<n>We evaluate our approaches across standard, few-shot, and noisy settings on multiple representative VLA architectures.
  arXiv  Detail & Related papers  (2026-02-04T05:37:09Z)
• Adversarially Robust and Interpretable Magecart Malware Detection [1.3266402517619371]
  Magecart skimming attacks have emerged as a significant threat to client-side security and user trust in online payment systems.<n>This paper addresses the challenge of achieving robust and explainable detection of Magecart attacks through a comparative study of various Machine Learning (ML) models with a real-world dataset.
  arXiv  Detail & Related papers  (2025-11-06T15:13:29Z)
• Secure Confidential Business Information When Sharing Machine Learning Models [15.330821160739232]
  Confidential Property Inference (CPI) attacks can exploit shared Machine Learning (ML) models to uncover confidential properties of the model provider's private model training data.<n>Existing defenses often assume that CPI attacks are non-adaptive to the specific ML model they are targeting.<n>We propose a novel defense method that explicitly accounts for the responsive nature of real-world adversaries.
  arXiv  Detail & Related papers  (2025-09-19T18:49:49Z)
• Real-Time Anomaly Detection and Reactive Planning with Large Language Models [18.57162998677491]
  Foundation models, e.g., large language models (LLMs), trained on internet-scale data possess zero-shot capabilities. We present a two-stage reasoning framework that incorporates the judgement regarding potential anomalies into a safe control framework. This enables our monitor to improve the trustworthiness of dynamic robotic systems, such as quadrotors or autonomous vehicles.
  arXiv  Detail & Related papers  (2024-07-11T17:59:22Z)
• Continuous Management of Machine Learning-Based Application Behavior [3.316045828362788]
  Non-functional properties of Machine Learning models must be monitored, verified, and maintained. We propose a multi-model approach that aims to guarantee a stable non-functional behavior of ML-based applications. We experimentally evaluate our solution in a real-world scenario focusing on non-functional property fairness.
  arXiv  Detail & Related papers  (2023-11-21T15:47:06Z)
• SecurityNet: Assessing Machine Learning Vulnerabilities on Public Models [74.58014281829946]
  We analyze the effectiveness of several representative attacks/defenses, including model stealing attacks, membership inference attacks, and backdoor detection on public models. Our evaluation empirically shows the performance of these attacks/defenses can vary significantly on public models compared to self-trained models.
  arXiv  Detail & Related papers  (2023-10-19T11:49:22Z)
• Predictable MDP Abstraction for Unsupervised Model-Based RL [93.91375268580806]
  We propose predictable MDP abstraction (PMA) Instead of training a predictive model on the original MDP, we train a model on a transformed MDP with a learned action space. We theoretically analyze PMA and empirically demonstrate that PMA leads to significant improvements over prior unsupervised model-based RL approaches.
  arXiv  Detail & Related papers  (2023-02-08T07:37:51Z)
• Defending Variational Autoencoders from Adversarial Attacks with MCMC [74.36233246536459]
  Variational autoencoders (VAEs) are deep generative models used in various domains. As previous work has shown, one can easily fool VAEs to produce unexpected latent representations and reconstructions for a visually slightly modified input. Here, we examine several objective functions for adversarial attacks construction, suggest metrics assess the model robustness, and propose a solution.
  arXiv  Detail & Related papers  (2022-03-18T13:25:18Z)
• Training Meta-Surrogate Model for Transferable Adversarial Attack [98.13178217557193]
  We consider adversarial attacks to a black-box model when no queries are allowed. In this setting, many methods directly attack surrogate models and transfer the obtained adversarial examples to fool the target model. We show we can obtain a Meta-Surrogate Model (MSM) such that attacks to this model can be easier transferred to other models.
  arXiv  Detail & Related papers  (2021-09-05T03:27:46Z)
• SafeAMC: Adversarial training for robust modulation recognition models [53.391095789289736]
  In communication systems, there are many tasks, like modulation recognition, which rely on Deep Neural Networks (DNNs) models. These models have been shown to be susceptible to adversarial perturbations, namely imperceptible additive noise crafted to induce misclassification. We propose to use adversarial training, which consists of fine-tuning the model with adversarial perturbations, to increase the robustness of automatic modulation recognition models.
  arXiv  Detail & Related papers  (2021-05-28T11:29:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.