TY - JOUR
T1 - An Empirical Study of Artifacts and Security Risks in the Pre-trained Model Supply Chain
AU - Jiang, Wenxin
AU - Synovic, Nicholas
AU - Sethi, Rohan
AU - Indarapu, Aryan
AU - Hyattt, Matt
AU - Schorlemmer, Taylor R.
AU - Thiruvathukal, George K.
AU - Davis, James C
N1 - Wenxin Jiang, Nicholas Synovic, Rohan Sethi, Aryan Indarapu, Matt Hyatt, Taylor R. Schorlemmer, George K. Thiruvathukal, and James C. Davis. 2022. An Empirical Study of Artifacts and Security Risks in the Pre-trained Model Supply Chain. In Proceedings of the 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED ’22), November 11, 2022, Los Angeles, CA, USA. ACM, New York, NY, USA, 10 pages. https: //doi.org/10.1145/3560835.3564547
PY - 2022/11/11
Y1 - 2022/11/11
N2 - Deep neural networks achieve state-of-the-art performance on many tasks, but require increasingly complex architectures and costly training procedures. Engineers can reduce costs by reusing a pre-trained model (PTM) and fine-tuning it for their own tasks. To facilitate software reuse, engineers collaborate around model hubs, collections of PTMs and datasets organized by problem domain. Although model hubs are now comparable in popularity and size to other software ecosystems, the associated PTM supply chain has not yet been examined from a software engineering perspective. We present an empirical study of artifacts and security features in 8 model hubs. We indicate the potential threat models and show that the existing defenses are insufficient for ensuring the security of PTMs. We compare PTM and traditional supply chains, and propose directions for further measurements and tools to increase the reliability of the PTM supply chain.
AB - Deep neural networks achieve state-of-the-art performance on many tasks, but require increasingly complex architectures and costly training procedures. Engineers can reduce costs by reusing a pre-trained model (PTM) and fine-tuning it for their own tasks. To facilitate software reuse, engineers collaborate around model hubs, collections of PTMs and datasets organized by problem domain. Although model hubs are now comparable in popularity and size to other software ecosystems, the associated PTM supply chain has not yet been examined from a software engineering perspective. We present an empirical study of artifacts and security features in 8 model hubs. We indicate the potential threat models and show that the existing defenses are insufficient for ensuring the security of PTMs. We compare PTM and traditional supply chains, and propose directions for further measurements and tools to increase the reliability of the PTM supply chain.
KW - Empirical studies
KW - Security and privacy
KW - software engineering
KW - artificial intelligence
KW - machine learning
UR - https://ecommons.luc.edu/cs_facpubs/315
U2 - 10.1145/3560835.3564547
DO - 10.1145/3560835.3564547
M3 - Article
JO - Computer Science: Faculty Publications and Other Works
JF - Computer Science: Faculty Publications and Other Works
ER -