- [Instructor] Open source models,
especially those available
through platforms like Hugging Face have definitely
democratized access to these state-of-the-art AI models
and AI capabilities, right?
So many models,
whether they are small language models
or large language models, for example,
meta, right, Meta Llama, it is very, very popular.
And of course, you know many iterations of these,
I just clicked on 3.1, the 8 billion parameter
instruct model.
However, there's hundreds of thousands
of models now available in platforms like Hugging Face.
So their use come with many opportunities
for pretty much every sector out there.
But also it comes with many challenges.
Let's explore some of the best practices
to maximize the benefits
of these AI models while mitigating the risks
of supply chain security, right?
So the first thing is that model selection and evaluation.
As a matter of fact, since I'm already here in front
of the Llama model, you see that
of course there's a model card which you learned earlier
that there are also capabilities for, you know, implementers
to actually have an AI BOM.
So an AI bill of materials.
But in this case, you know, we actually have a model
card in here.
You have information about licensing
and as a matter of fact, that's one of the things even
outside of security that you definitely
have to pay attention to.
So especially if you work for a company that is thinking
to commercialize the use of the AI model
or the AI implementation, you definitely have
to pay attention to the license agreement, right?
Some of the models will not allow you to use it
for commercial purposes.
Other ones, they do, right?
So if you're not sure of the different type of structures
for licensing and everything, you know,
definitely I'll advise you to consult with your, you know,
legal department within your organization.
However, thoroughly review the model documentation,
including its intended use cases
and also the limitations as well.
Many of the models actually provide a lot
of information about their architecture.
As you're seeing here, the model card for Llama 3.1,
which is the one that I actually just selected in here,
provides information about the training data,
the parameter count, the input modalities,
the output modalities as well.
And of course information about the context length,
which in this case is only 128K
for the context length.
You know, as models actually become more effective
and more, you know, better,
the context windows are also increasing.
However, going back to the model selection in here,
definitely the intended use is one of the things
that you should pay attention to and the out of scope,
right?
And especially you see many
corporations using basically the same language that it says
that in a matter that violates applicable laws
or regulations, including trade compliance laws, that
that's outta scope of this model.
And also the use in languages
beyond the ones that are explicitly referenced
as supported in the model card are also outta
scope in here, right?
So these model cards also allow you to understand how
to use the model.
Now the other thing of course you have
to check the performance models metrics
and evaluate them in the context of your specific task.
Assess the training data, right?
For potential biases,
for potential ethical concerns and so on.
In very large data sets, like the ones that you know,
these models like Llama
and you know many others you know in the industry actually
use, these are gonna be very, very hard for you
to actually assess the training data for any potential bias.
Of course, you know, this is actually something
that you probably have to do with red teaming
of your AI implementation right?
Now, the other thing, of course, you have
to consider the model size
and the computational requirements.
That's a given, right?
But from the security perspective, you have
to verify the source and the integrity of the model.
Nowadays there's a lot of push for model signing.
So cryptographically signing models to be aware
of any type of manipulation
or any type of changes in the integrity of the model
that you're actually downloading. And then using.
Be aware also of potential security vulnerabilities
in pre-trained model architectures.
A lot of the assisting models that you see in Hugging Face
and across the industry,
they are still using the architecture from pickle.
And Pickle is a library, you know, it's an ecosystem,
a framework that unfortunately didn't have security
considerations from the start
and attackers actually know that
and they were actually able to manipulate these models.
As a matter of fact, if you actually go to the NIST
publication that we were going over earlier in the course,
the adversarial machine learning, you know, taxonomy
and terminology for attacks,
it also talks about de-serialization vulnerabilities.
And as you're seeing here, you know, is actually telling you
that many ML projects, so machine learning projects begin
with downloading an open source gen AI model of course
to use in an application.
And there are different formats for serialization that allow
for arbitrary code execution.
And this is actually a really important element in here.
There has been several examples throughout the years,
you know, dating back to 2022 and 2019 for many
of these vulnerabilities within the pickle
neural network tools
and pickle is definitely, you know, one
that has been under the radar for quite some time
whenever it comes to security and now more
and more vulnerabilities
are actually found in these formats.
But that's not the only one.
Of course, PyTorch, joblib, NumPy as you're seeing here,
TensorFlow, nothing is immune to vulnerabilities.
So you have to pay attention to that of course.
And also any other types of like poisoning attacks
and so on that we discuss earlier in the course.
So once again, the pickle module is not secure against
erroneous or malicious constructed data
and it's possible for a pickle file
to then execute arbitrary code
during de-serialization process, right?
So, which of course is introducing the risk
that I mentioned to you earlier.
There are a few alternatives for that
for large language models
or when security is a concern,
other serialization methods like joblib
or J O B lib, which is
for NumPy, you know, arrays or other formats like
JSON or HDF5.
Now there's another architecture called Safe Tensors
and this is a new
file format that was actually developed by Hugging Face
for storing tensors safely and efficiently
and especially in the context of deep learning applications
and NLP and of course transformer based models.
So it addresses a lot of the limitations associated
with the traditional serialization formats like pickle
and the other ones that I mentioned to you earlier.
Now, unlike those formats, you know,
safe tensors do not allow for the execution
of arbitrary code.
So making it of course a safer option for model distribution
and for model storage, this is really important
of course in these open source environments
whenever the models are shared widely
and could potentially contain malicious code.
So hopefully a lot of these model suppliers
and model, you know, providers, they are now, you know,
paying attention to this and using safe tensors which are
designed not only to increase the security,
but also introduces a lot of benefits around speed
and efficiency and is, you know, they're designed
to actually be fast and offer significant performance
improvements as well.
The other cool thing about safe tensors is
that the format is designed to be simple
and compatible across many different programming languages,
including Python, C, or C++, Java, JavaScript, rust,
and many others, right?
So they also support this thing called lazy loading,
which basically allows only a portion of the tensors
to be loaded into memory.
So again, safe tensors is increasingly being adopted
by many different AI frameworks and many AI projects
and of course model providers.
As a matter of fact, the one that you see in front
of you is from Mistral AI.
And especially I just randomly pick, you know,
one in here is one of the older one for Mistral, you know,
7B instruct the version 0.1.
But if I go to the files
and versions, you actually see down below a JSON file
for serialization in this case using the safe tensors index.
Now, to implement safe tensors, you need
to follow a few straight force steps
for installation and usage.
Basically you can install the safe tensors library either
using PIP in Python, so PIP installed safe tensors
or Conda in the case of Anaconda, right?
So once you install it, you can use the safe tensors library
to save and load those tensors.
And you see a few files in here with some
of the, you know, the implementations
of a safe tensors library.
So you have the index.JSON file.
As a matter of fact, Hugging Face has a pretty cool utility
here where you can convert any model to safe tensors
and basically open a pool request to then change it, right?
So this is a really cool community effort on
where if you know the model ID, you can put it here.
Let's say, you know, in this case I can go
and type Mistral 7Bs.
So in this case I'm gonna copy and paste the mistrial.
And of course they already converted that,
but I'm gonna submit it anyway so you can see,
and of course you get an error message that's saying
that the model is already converted.
So it's actually skipping that one.
So if you go to the GitHub repository for Hugging Face,
so you know the organization Hugging Face
and the safe tensors repository,
you actually even see a few of the attacks
that, you know, a few Python scripts in here that can test,
you know, the different attacks against
different implementation.
So as a matter of fact, if you're seeing here, this is
for showcasing different types of red team,
if you will, you know, implementations
or red team attacks against AI models
that you can try out, right?
So from Torch arbitrary code execution
to a few other, you know, architectural components
that also lead to code execution like
PaddlePaddle, TensorFlow Keras,
Torch denial of service attacks as well.
So a few denial of service attacks
and even abuse against safe tensors, right?
So there's a few tests in there that you can employ
by using these three, you know, libraries that
of course they're all included within
this github repository.
So again, this is only for your reference, so you
too become familiar with some of the flaws
of not only the architectures
but the implementations of AI models, especially those
that are open source
and that are widely available in the industry.