Poisoning Risks to AI Models via Training Data and Model Metadata

Security researchers and activists are highlighting multiple avenues for AI model poisoning, spanning both the software supply chain around model artifacts and the upstream data used to train models. Palo Alto Networks’ Unit 42 reported that popular AI/ML Python libraries used with Hugging Face-hosted models can be abused to hide malicious code in model metadata that may execute when a poisoned file is loaded, expanding the attack surface for organizations that download and run third‑party models.

Unit 42 tied the issue to libraries including Nvidia NeMo, Salesforce Uni2TS, and FlexTok (Apple/EPFL VILAB), which rely on Meta’s Hydra configuration framework—specifically the instantiate() function—prompting maintainers to issue fixes and, in some cases, assign CVEs; no in-the-wild exploitation was reported at the time. Separately, the Poison Fountain initiative is advocating intentional poisoning of AI training data by encouraging website operators to embed links that lead AI crawlers to corrupted content (including subtly wrong code) to degrade model quality, reflecting escalating debate over AI safety and the practicality of data poisoning attacks against model performance.