Real-World Impact Scenarios

ML Model Hub Compromise

Attackers upload a malicious .keras model to a public repository (e.g., Hugging Face, Kaggle).
When a victim downloads and loads the model, SSH private keys or local configuration files may be exposed.

Attack vector:

1. Attacker uploads a malicious .keras model file to the public repository
2. The model's StringLookup layer is configured with vocabulary="/home/victim/.ssh/id_rsa"
3. Victim downloads and loads the model for evaluation or fine-tuning
4. SSH private key contents are read into the model's vocabulary during deserialization
5. Attacker retrieves the key by re-downloading the model or through vocabulary exfiltration

Potential impact: complete compromise of victim's SSH access to servers, code repositories, and cloud infrastructure. Attackers can pivot to active intrusion: clone private repos, inject backdoors or malicious commits into CI/CD, execute code in production, and move laterally.

Cloud Credential Theft

ML engineers deploying models in AWS/GCP/Azure environments with instance metadata services. Malicious model references metadata endpoints (e.g., http://169.254.169.254/) so loading it in a cloud VM/container returns IAM credentials.

Attack vector:

1. Attacker crafts a model with vocabulary="http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name"
2. Model is loaded in a cloud VM or container with IAM role attached
3. AWS credentials (access key, secret key, session token) are fetched at load time
   Credentials populate the vocabulary and can be exfiltrated via get_vocabulary()

Potential impact: Full access to cloud resources under the compromised role. Attackers can take over infrastructure, exfiltrate data, deploy ransomware or crypto mining, erase logs, and pivot access across accounts. 

Supply Chain Attack via Pre-trained Models

Attacker publishes or poisons a popular pre-trained model that references local credential files (.gitconfig, .netrc) so CI/CD or developer machines leak tokens when the model is loaded. Development teams using third-party pre-trained models for transfer learning may import these models and expose Git tokens, API keys, and source code.

Attack vector:

1. Attacker compromises a popular pre-trained model repository or creates a malicious "state-of-the-art" model
2. Model contains StringLookup with vocabulary="file:///home/developer/.gitconfig" or "file:///home/developer/.netrc"
3. Developers load the model in CI/CD pipelines or local development environments
4. Git credentials, authentication tokens, and repository access details are extracted
5. Attacker gains access to private source code repositories

Potential impact: Stolen dev credentials enable source code/IP theft and insertion of malicious code and backdoors into builds and signed artifacts. Backdoor releases can propagate downstream to customers and partners, triggering widespread compromise.