Collaborating for Safer AI: Hugging Face Teams Up with VirusTotal

We’re thrilled to unveil an important partnership between Hugging Face and VirusTotal, a leader in threat intelligence and malware analysis. This collaboration marks a significant step toward enhancing the security of files shared across the Hugging Face Hub, ultimately protecting the machine learning community from potential threats posed by malicious or compromised assets.

Why This Matters

Artificial Intelligence (AI) models are powerful tools, but they come with inherent risks as complex digital artifacts. They may encompass large binary files, serialized data, and various dependencies, all of which can carry hidden dangers. Currently, the Hugging Face Hub boasts over 2.2 million public model artifacts. As we expand to become the world’s largest open platform for machine learning models and datasets, it is vital to ensure that shared assets are secure.

Potential Threats

The threats to shared files can manifest in various ways:

• Malicious payloads disguised as legitimate model files or archives.
• Files that have been compromised prior to their upload.
• Binary assets connected to known malware campaigns.
• Dependencies or serialized objects that may execute unsafe code when loaded.

By partnering with VirusTotal, we are enhancing the safety and visibility of the files shared through Hugging Face by allowing them to be checked against one of the world’s most comprehensive malware intelligence databases.

How the Collaboration Works

When users visit a repository page or a file or directory page on the Hugging Face Hub, the system will automatically retrieve VirusTotal information about the corresponding files. Here’s a simplified overview of the process:

More Read

Exploring the Impact of Language-Centric Foundation Models on Reasoning in Large Language Models

Optimizing Visual Question Answering with Task Progressive Curriculum Learning

Enhancing the Robustness of Kernel Goodness-of-Fit Tests: Insights from Research [2408.05854]

XLSR-Kanformer: Innovative KAN-Integrated Model for Accurate Synthetic Speech Detection

Automating Safety Requirements Derivation with Agent-Based Risk Assessment Graphs (RAG)

1. File Hash Comparison: The file hash is checked against VirusTotal’s threat intelligence database.
2. Status Retrieval: If the file hash has been previously analyzed, the status (clean or malicious) is fetched.
3. Privacy Maintenance: To ensure user privacy, no raw file contents are shared with VirusTotal, adhering to Hugging Face’s data protection guidelines.
4. Metadata Results: Key information such as detection counts, known-bad relationships, and relevant threat-campaign intelligence are provided.

This method grants users valuable context before downloading or integrating files from the Hub.

Benefits for the Community

The collaboration between Hugging Face and VirusTotal offers numerous advantages for the community:

• Transparency: Users can easily check if files have been flagged or analyzed within VirusTotal’s ecosystem.
• Safety: Organizations can incorporate VirusTotal checks into their CI/CD or deployment workflows, significantly reducing the risk of deploying malicious assets.
• Efficiency: By leveraging VirusTotal’s existing intelligence, the need for repeated or redundant scanning is minimized, streamlining the process.
• Trust: Together, we are striving to make the Hugging Face Hub a more secure and reliable platform for open-source AI collaboration.

Join Us in Making AI Collaboration Safer

If you’re keen to learn more about this integration or wish to explore ways to contribute to a safer open-source AI ecosystem, don’t hesitate to reach out at security@huggingface.co.

Through this partnership, we’re not just making AI collaboration open; we’re embedding security into the very fabric of our community.

Inspired by: Source