ML data-loader injection is abusing the configuration or metadata of a machine-learning dataset or model file so that parsing it runs code or reads files. Dataset configs can hold template expressions (Jinja2 SSTI), external file references (HDF5 external storage), or protocol specs (fsspec reference paths) that a loader evaluates on load. Because ML pipelines fetch and parse untrusted artifacts automatically, loading one becomes an execution or file-read primitive. Defend by disabling evaluation and external references, sandboxing parsing, and preferring safe formats.
What ML data-loader injection is
ML frameworks load datasets and models by reading files and their configuration, and that configuration is attacker-controllable when the artifact comes from a public hub or an untrusted upload. If the loader evaluates the config, resolves external references, or renders templates in it, the attacker who authored the artifact controls what the loader does. Parsing, which teams treat as harmless, becomes an attack surface.
How it works and example
Several vectors share this shape. Template expressions in a dataset config reach the Python object graph and run code (Jinja2 SSTI). An HDF5 dataset configured for external storage points at a local path and returns that file's contents (HDF5 external storage file read). A reference-protocol spec with manipulated offset fields injects a payload into the loader (fsspec reference abuse). All fire the moment an unsuspecting pipeline loads the artifact.
How to defend against it
Treat datasets and models like untrusted code. Turn off template evaluation and external or remote references in loaders, validate config against a strict schema, and parse untrusted artifacts in a sandbox with no filesystem or network access. Prefer formats that carry no executable behaviour, such as safetensors, and verify the source of anything you load.
References
- [1]MITRE ATLAS, Adversarial ML tactics(MITRE)
- [2]HuggingFace, Agent intrusion technical timeline(HuggingFace)
If your pipeline auto-loads datasets or models from anywhere untrusted, this is in scope. Talk to a security expert about testing your loaders.