During a security audit, a reviewer examines the models used by the NLP team. She searches Hugging Face Hub and finds the team's code references 'bert-base-uncasedd' - subtly different from the canonical 'bert-base-uncased'. The repository shows 847 downloads, was created 3 weeks ago by a user with zero other contributions, and the model card was copied verbatim from the real model.
A developer finds a Hugging Face repository named 'bert-base-uncasedd' (with a double 'd') that has a model with identical performance to the legitimate 'bert-base-uncased' but was uploaded by an unknown account 3 weeks ago. What attack is this most likely an example of?
- A.A. Model inversion attack - the uploader reconstructed BERT's weights from API queries
- B.D. Model distillation theft - the uploader compressed the original model to reduce size
- C.C. Adversarial patch attack - the model contains hidden triggers for specific inputs
- D.B. Typosquatting - a malicious actor registers a name similar to a popular model to trick developers into downloading a potentially backdoored version
Why D is correct
Typosquatting in the model repository context mirrors PyPI/npm package typosquatting: an attacker registers a model name one character away from a popular model. Developers who mistype the name or find it via search may download a model that looks legitimate (matching performance) but contains a backdoor or malicious pickle code. This is cataloged in MITRE ATLAS as ML Supply Chain Compromise.
Know someone studying for AI Security Fundamentals? Send them this one.