Daily Papers

Model hosting hubs (e.g., Hugging Face) are vulnerable to supply chain attacks that enable remote code execution on trusted user environments. Attackers often distribute malicious Pre-trained ML models (PTMs) via model hubs. In this paper, we present novel attacks against PTMs and model hubs called SHADOWPICKLE. SHADOWPICKLE includes three (3) stealthy pickle deserialization attacks that enable malicious behaviors and evade state-of-the-art (SOTA) model scanners. These attacks leverage the external module import mechanism of the Pickle Virtual Machine (VM) to execute malicious payloads during deserialization. Additionally, we provide PICKLEBENCH, a dynamic and extensible benchmark for automatically injecting SHADOWPICKLE into arbitrary benign PTM models. Our evaluation shows that SHADOWPICKLE evades ten SOTA scanners, and four model hubs. SHADOWPICKLE (Overwritten) has a 63% evasion rate across scanners, and up to 50% higher evasion rates than existing attacks. Besides, PICKLEBENCH is up to 25.6% more challenging than three SOTA benchmarks. Finally, we provide security recommendations for mitigating our attacks and improving the effectiveness of existing scanners. Our findings highlight the limitations of existing PTM scanners and suggest directions for improvements.

Post-training has become the dominant recipe for turning a language model into a competent search-augmented reasoning agent. A line of recent work pushes its performance further by adding elaborate machinery on top of this standard pipeline. These augmentations import external supervision from stronger external systems, attach auxiliary modules such as process reward models or retrospective critics, restructure the rollout itself with tree search or multi-stage curricula, or shape the reward with hand-crafted bonuses and penalties. Each addition delivers a measurable gain, but each also inflates the training pipeline and ties the recipe to resources or designs that may not always be available. We take a step back and ask whether any of this machinery is actually necessary, and propose Search-E1, a self-evolution method that lets a search-augmented agent improve through only vanilla GRPO interleaved with on-policy self-distillation (OPSD). After each GRPO round, the policy rolls out on its own training questions. A token-level forward KL objective then aligns the policy's inference-time distribution to its own distribution under a privileged context that exposes a more efficient sibling trajectory. Despite this simplicity, the procedure naturally provides dense per-step supervision. On seven QA benchmarks, Search-E1 reaches 0.440 average EM with Qwen2.5-3B, surpassing all open-source baselines at both scales. Code and complete version will be made public soon.

Python programs pay for their imports at every process start, a cost that is invisible in steady-state benchmarks but dominant for command-line tools, test workers, and serverless cold starts. Python 3.15 adds explicit lazy imports (PEP 810) on largely anecdotal evidence. We measure the import cost of the 500 most-downloaded PyPI packages, every quarterly release since mid-2021, under six CPython versions (3.9-3.14) on two platforms (Apple M5/macOS and Intel Xeon/Linux): all 66,816 package-version-interpreter cells, plus the release histories of 65 distributions beneath shared namespaces, and targeted experiments that isolate individual effects. Import cost is heavily skewed (median 12.3 ms, 99th percentile 400 ms on macOS). For the median package, 68-79% of import time is spent importing the standard library, while third-party dependencies are the largest component in the slowest decile. The cold first import is almost entirely bytecode compilation on Linux, but on macOS 67% of the cold penalty remains when bytecode is precompiled: we trace it to the operating system's security assessment of each new native library, which every fresh environment pays again. A package's own import code grows by a median 4.0-5.0% per year; resolving dependencies as of each release raises the median trend of the total from 1.8% to 3.0-3.4% per year. CPython 3.14 executes package code faster than 3.9 but imports more and slower standard-library modules, a net 1.16x slowdown on macOS and 1.07x on Linux. What dependents actually import from a package costs a median 1.0x its top-level import but 10.9-13.4x at the 90th percentile. Global lazy mode makes import statements essentially free and breaks 10 packages. Harness, analysis code, and dataset are public.