Loading…
Hugging Face and VirusTotal collaborate to strengthen AI security
Hugging FaceAdrien Carreira, Bernardo Quintero
Summary
Hugging Face announced a collaboration with VirusTotal to enhance the security of files shared across the Hugging Face Hub. Hosting more than 2.2 million public model and dataset repositories, the platform faces potential threats from malicious payloads, compromised files, and dependencies that execute unsafe code. Starting immediately, public repositories on the Hub undergo continuous scanning powered by VirusTotal threat intelligence. When users view repository or file pages, the Hub checks file hashes against VirusTotal without transferring raw file contents, preserving user privacy. Retrieved metadata displays detection counts, clean or malicious status, and known-bad relationships, enabling organizations to evaluate risks prior to downloading assets or integrating them into deployment pipelines.
Context
Artificial intelligence models and datasets are complex digital artifacts containing large binary files, serialized data, and dependencies that can carry risks such as disguised malicious payloads, compromised files, malware links, or unsafe execution code. Hugging Face Hub hosts over 2.2 million public model artifacts, making security verification necessary to protect the machine learning community from malicious assets.
Approach / What changed
Hugging Face integrated continuous scanning with VirusTotal across all 2.2 million public repositories. When users visit repository or file pages, the Hub queries VirusTotal by comparing file hashes against its threat intelligence database without sending raw file contents. The integration retrieves statuses, detection counts, known-bad relationships, and threat campaign metadata.
Takeaways
- Hugging Face is continuously scanning over 2.2 million public model and dataset repositories using VirusTotal threat intelligence.
- To preserve user privacy and data protection principles, Hugging Face checks file hashes against VirusTotal rather than sharing raw file contents.
- Scan results presented on repository and file pages include detection counts, clean or malicious status, known-bad relationships, and associated threat-campaign intelligence.
Related reading
Building for an Open Future - our new partnership with Google Cloud
Hugging Face and Google Cloud announced an expanded strategic partnership designed to streamline the deployment and management of open models on Google Cloud infrastructure. Prompted by a tenfold increase in Hugging Face usage on Google Cloud over three years, the collaboration introduces a joint CDN Gateway using Hugging Face Xet technology to cache models and datasets directly on Google Cloud. This caching mechanism aims to shorten download times, strengthen model supply chain resilience, and accelerate time-to-first-token across Vertex AI, Google Kubernetes Engine, Cloud Run, and Compute Engine virtual machines. Hugging Face plans to integrate native library support for Google Cloud TPUs, lower instance prices on Inference Endpoints, and enhance Hub security scanning via VirusTotal, Google Threat Intelligence, and Mandiant.
Jeff Boudier, Simon Pagezyhuggingface.co ·
We Raised $100 Million for Open & Collaborative Machine Learning 🚀
Hugging Face announced a 100 million dollar Series C funding round led by Lux Capital, alongside participants including Sequoia, Coatue, and several angel investors. The platform hosts over 100,000 pre-trained models and 10,000 datasets spanning natural language processing, computer vision, speech, and other scientific domains for more than 10,000 customer organizations. The company plans to use the capital to expand research, open-source initiatives, tooling, and efforts focused on mitigating machine learning limitations like biases, privacy risks, and energy consumption. In addition, the organization is directing the BigScience research workshop with over 1,000 participants to train a massive open-source multilingual language model. Following organizational growth from 30 to more than 120 employees in twelve months, the remote-friendly company is actively hiring across all positions and seniority levels.