A Closer Look at the Malicious Pre-Trained Models in the Hugging Face

Replication Package of Paper “A Closer Look at the Malicious Pre-Trained Models in the Hugging Face” # Overview This project presents a comprehensive empirical study on the security risks posed by malicious pre-trained models (PTMs) in the Hugging Face ecosystem. We construct the largest known dataset of malicious PTMs, comprising 18,195 models, and systematically analyze their prevalence, attack tactics, behavioral characteristics, evasion strategies, detection effectiveness, and lifecycle. Our analysis reveals that malicious PTMs often evade existing detection tools through advanced techniques such as API obfuscation, payload fragmentation, and misuse of auxiliary files. Besides, we find that many malicious models remain publicly accessible for extended periods, accumulating user trust and downloads before being flagged. This replication package contains the datasets, scripts, and analysis tools necessary to reproduce our key findings and support future research on securing the AI model supply chain. # Directory Structure ├── script/│ ├── dataset_collection.csv # collect all PTMs from Hugging Face using its API│ ├── dataset_spider.csv # collect model card, model size, tensor type, and warning messages of PTMs in HF│ ├── dataset_analyze.csv # the script to analyze dataset in RQ1 to RQ5│ └── feature_extraction.py # collect and identify malicious PTMs from ProtectAI website├── dataset/│ ├── all_models_api_list_0701.csv # All PTMs in Hugging Face before June 30, 2025│ ├── all_models_0701_malicious.csv # Malicious PTMs with unique model names│ ├── sample_dataset_rq3.csv # Sample dataset used in RQ3│ ├── sample_models_final_rq4.xlsx # Sample dataset used in RQ4│ └── all_models_0701_malicious_noduplicate.csv # All malicious PTMs ├── interviews/│ └── questionnair.pdf # ├── results/│ ├── category_year_trend.pdf # │ ├── completeness_model_card.pdf # │ ├── download_trend_by_category.pdf # │ ├── like_download_distribution_rq3.pdf # │ ├── like_trend_by_category.pdf # │ ├── malicious_like_download_distribution_by_count.pdf # │ ├── malicious_trend_by_year.pdf # │ ├── models_per_month_trend.pdf # │ ├── prediction_by_methods.pdf # │ ├── category_year_trend.pdf # │ └── scatter_figure.pdf # ├── environment.yaml└── README.md # # Environment & Setup conda create -n ptm-threat python=3.10conda activate ptm-threat conda env create -f environment.yaml