# EvilModel: Hiding Malware Inside of Neural Network Models

arXiv: https://arxiv.org/abs/2107.08590 · HTML: https://mlsanity.com/paper/2107.08590/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 22 references that are in the map.
- First posted on arXiv 19 Jul 2021.

## Builds on (most cited first, 3 of 3)

- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Steganographic Generative Adversarial Networks](https://mlsanity.com/paper/1703.05502/) (2017)
- [Hydras and IPFS: A Decentralised Playground for Malware](https://mlsanity.com/paper/1905.11880/) (2019)

## Built on by (most cited first, 16 of 16)

- [An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registry](https://mlsanity.com/paper/2303.02552/) (2023)
- [EvilModel 2.0: Bringing Neural Network Models into Malware Attacks](https://mlsanity.com/paper/2109.04344/) (2021)
- [An Empirical Analysis of Machine Learning Model and Dataset Documentation, Supply Chain, and Licensing Challenges on Hugging Face](https://mlsanity.com/paper/2502.04484/) (2025)
- [Transpose Attack: Stealing Datasets with Bidirectional Training](https://mlsanity.com/paper/2311.07389/) (2023)
- [Machine Learning Models Have a Supply Chain Problem](https://mlsanity.com/paper/2505.22778/) (2025)
- [Do You Trust Your Model? Emerging Malware Threats in the Deep Learning Ecosystem](https://mlsanity.com/paper/2403.03593/) (2024)
- [On the Steganographic Capacity of Selected Learning Models](https://mlsanity.com/paper/2308.15502/) (2023)
- [Hiding Images in Diffusion Models by Editing Learned Score Functions](https://mlsanity.com/paper/2503.18459/) (2025)
- [On the (In)Security of Loading Machine Learning Models](https://mlsanity.com/paper/2509.06703/) (2025)
- [Steganographic Capacity of Deep Learning Models](https://mlsanity.com/paper/2306.17189/) (2023)
- [SafePickle: Robust and Generic ML Detection of Malicious Pickle-based ML Models](https://mlsanity.com/paper/2602.19818/) (2026)
- [Bit-wise Training of Neural Network Weights](https://mlsanity.com/paper/2202.09571/) (2022)
- [Covert Communication Based on the Poisoning Attack in Federated Learning](https://mlsanity.com/paper/2306.01342/) (2023)
- [Model X-Ray: Detection of Hidden Malware in AI Model Weights using Few Shot Learning](https://mlsanity.com/paper/2409.19310/) (2024)
- [MEASER: Malware embedding attacks on open-source LLMs](https://mlsanity.com/paper/2510.10486/) (2025)
- [GrayShield: Bit-Level Sanitization for Transformer Model Supply-Chain Security](https://mlsanity.com/paper/2610.04319/) (2026)

## Abstract (arXiv)

Delivering malware covertly and evasively is critical to advanced malware campaigns. In this paper, we present a new method to covertly and evasively deliver malware through a neural network model. Neural network models are poorly explainable and have a good generalization ability. By embedding malware in neurons, the malware can be delivered covertly, with minor or no impact on the performance of neural network. Meanwhile, because the structure of the neural network model remains unchanged, it can pass the security scan of antivirus engines. Experiments show that 36.9MB of malware can be embedded in a 178MB-AlexNet model within 1% accuracy loss, and no suspicion is raised by anti-virus engines in VirusTotal, which verifies the feasibility of this method. With the widespread application of artificial intelligence, utilizing neural networks for attacks becomes a forwarding trend. We hope this work can provide a reference scenario for the defense on neural network-assisted attacks.