安全港湾还是险恶水域：揭示 PyTorch 中 TorchScript 引擎的隐藏风险（预录制）.pdf

1、#BHUSA BlackHatEventsSafe Harbor or Hostile Waters:Unveiling the Hidden Perils of the TorchScriptEngine in PyTorchJian Zhou,Lishuo Song1#BHUSA BlackHatEventsJian ZhouSecurity Engineer from Alibaba CloudTwitter:azraelxuemoLishuo SongSecurity Engineer from Alibaba CloudTwitter:ret2ddmeAbout Us2#BHUSA

2、BlackHatEventsIntroduction&BackgroundWhere It All BeganTorchScript 101How weights_only WorksDefense&SummaryThe ImpactAgenda3#BHUSA BlackHatEventsIntroduction to PyTorch4#BHUSA BlackHatEventsWhat Is PyTorch?5#BHUSA BlackHatEventsPyTorch Key Use Cases6#BHUSA BlackHatEventsML Frameworks7#BHUSA BlackHat

3、EventsMarket Sharehttps:/ BlackHatEventsWhere It All Began9#BHUSA BlackHatEventsInitially,Use Pickle to Save Model10#BHUSA BlackHatEventsPickle Is Not Safehttps:/docs.python.org/3/library/pickle.htmlhttps:/docs.python.org/3/library/pickle.html11#BHUSA BlackHatEventsCommunity Discussionhttps:/ BlackH

4、atEventsIntroducing weights_only Parameterhttps:/ BlackHatEventsImplementation14#BHUSA BlackHatEventsTry It Out:weights_only=False15#BHUSA BlackHatEventsTry It Out:weights_only=True16#BHUSA BlackHatEventshttps:/ Security Statement17#BHUSA BlackHatEventsCommunity Trust in weights_only:A Case Studyhtt

5、ps:/ BlackHatEventshttps:/ BlackHatEventsFollow the Crowd?20#BHUSA BlackHatEventsHow weights_only Works21#BHUSA BlackHatEvents Before we analyze how weights_only is implemented,we need to understand how pickle works.22#BHUSA BlackHatEventsload_global23#BHUSA BlackHatEventsload_unicode&load_tuple124#

6、BHUSA BlackHatEventsload_reduce25#BHUSA BlackHatEvents How does weights_only address this issue?26#BHUSA BlackHatEventsRestricted load_global27#BHUSA BlackHatEventsRestricted load_reduce28#BHUSA BlackHatEventsHow to Bypass?29#BHUSA BlackHatEventsNo Useful Results from Whitelist Analysis30#BHUSA Blac