Lifecycle-Aware Dynamic Analysis for Secure ML Model Execution

A research team has proposed Moat, a dynamic lifecycle-aware defense for machine learning model execution that detected all evaluated attack classes while maintaining a close-to-zero false-positive rate in tests against 77,974 real-world model artifacts from the Hugging Face Hub [1]. The approach, detailed in a paper by Gabriele Digregorio and submitted to arXiv on 17 June 2026, shifts security analysis away from static, format-specific rules that dominate current model-scanning tools [1]. Existing defenses often inspect serialization formats like Pickle for known dangerous opcodes, but recent proofs-of-concept have shown that malicious payloads can be hidden in method bytecode, bypassing scanners that rely on opcode deny-lists [8]. Moat instead monitors security-relevant events at the boundary between the ML execution environment and the host system, focusing on file-system access, network communication, process creation, and device interaction [3]. The system defines an allowlist of expected behaviors by profiling benign model executions across well-defined lifecycle phases, under the observation that interactions with the host system are highly structured and predictable [1][3]. The reference implementation, called Re-Moat, was evaluated against 31 proofs-of-concept drawn from public CVEs and 334 models from a state-of-the-art dataset, in addition to the Hugging Face corpus [1]. The work builds on a growing body of research into dynamic analysis for model security. A separate technique called DynaHug, proposed in earlier work, used system-call traces and one-class SVM models to learn benign model behavior, operating on the insight that malicious models exhibit outlier behaviors rarely seen in benign ones [4][9]. Another system, PickleBall, tackled Pickle-based models by statically analyzing library code to infer allowed imports and invocations, then enforcing those policies during loading [5]. Moat distinguishes itself by remaining agnostic to the underlying model format and by monitoring across the full execution lifecycle rather than only during deserialization [3]. The paper’s authors argue that instrumenting internal framework APIs is unreliable under their threat model, even when the framework is trusted, because attackers can embed logic that fires at inference time, outside the window monitored by sandboxes that only observe deserialization [3][8]. The submission package totals 52 KB [1].