Definition
An attack that hides malicious code or files inside a model repository (such as Hugging Face, LM Studio, or MLflow) and triggers it when the model is downloaded or loaded. Because teams treat downloaded models as trusted software, the payload can run with the caller's privileges before the model is even used.
Why it matters
A single poisoned model can give an attacker code execution on the server that loads it, and public model hubs have already been used to deliver cryptominers and backdoors.