AI security lab · Supply Chain Attacks

ML Dependency Confusion Attack

ML pipelines depend on packages from multiple registries. A dependency confusion attack publishes a malicious package with the same name as an internal package to a public registry, hijacking the install. **Challenge:** A company's ML training pipeline uses an internal package called 'ml-data-utils'. An attacker has published 'ml-data-utils' on PyPI with a higher version number. Demonstrate how the pipeline gets compromised during the next pip install.