# Machine Learning Systems are Bloated and Vulnerable

arXiv: https://arxiv.org/abs/2212.09437 · HTML: https://mlsanity.com/paper/2212.09437/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 82 references that are in the map.
- First posted on arXiv 16 Dec 2022.

## Builds on (most cited first, 15 of 15)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [SQuAD: 100,000+ Questions for Machine Comprehension of Text](https://mlsanity.com/paper/1606.05250/) (2016)
- [Caffe: Convolutional Architecture for Fast Feature Embedding](https://mlsanity.com/paper/1408.5093/) (2014)
- [MXNet: A Flexible and Efficient Machine Learning Library for Heterogeneous Distributed Systems](https://mlsanity.com/paper/1512.01274/) (2015)
- [Small World with High Risks: A Study of Security Threats in the npm Ecosystem](https://mlsanity.com/paper/1902.09217/) (2019)
- [PRETZEL: Opening the Black Box of Machine Learning Prediction Serving Systems](https://mlsanity.com/paper/1810.06115/) (2018)
- [Studying the Practices of Deploying Machine Learning Projects on Docker](https://mlsanity.com/paper/2206.00699/) (2022)
- [Debloating Software through Piece-Wise Compilation and Loading](https://mlsanity.com/paper/1802.00759/) (2018)
- [A Comprehensive Study of Bloated Dependencies in the Maven Ecosystem](https://mlsanity.com/paper/2001.07808/) (2020)
- [Coverage-Based Debloating for Java Bytecode](https://mlsanity.com/paper/2008.08401/) (2020)
- [A Longitudinal Analysis of Bloated Java Dependencies](https://mlsanity.com/paper/2105.14226/) (2021)
- [CARVE: Practical Security-Focused Software Debloating Using Simple Feature Set Mappings](https://mlsanity.com/paper/1907.02180/) (2019)
- [The Used, the Bloated, and the Vulnerable: Reducing the Attack Surface of an Industrial Application](https://mlsanity.com/paper/2108.05115/) (2021)
- [Lightweight, Multi-Stage, Compiler-Assisted Application Specialization](https://mlsanity.com/paper/2109.02775/) (2021)

## Built on by (most cited first, 2 of 2)

- [TaxBreak: Unmasking the Hidden Costs of LLM Inference Through Overhead Decomposition](https://mlsanity.com/paper/2603.12465/) (2026)
- [Stdlib or Third-Party? Empirical Performance and Correctness of LLM-Assisted Zero-Dependency Python Libraries](https://mlsanity.com/paper/2605.21405/) (2026)

## Abstract (arXiv)

Today's software is bloated with both code and features that are not used by most users. This bloat is prevalent across the entire software stack, from operating systems and applications to containers. Containers are lightweight virtualization technologies used to package code and dependencies, providing portable, reproducible and isolated environments. For their ease of use, data scientists often utilize machine learning containers to simplify their workflow. However, this convenience comes at a cost: containers are often bloated with unnecessary code and dependencies, resulting in very large sizes. In this paper, we analyze and quantify bloat in machine learning containers. We develop MMLB, a framework for analyzing bloat in software systems, focusing on machine learning containers. MMLB measures the amount of bloat at both the container and package levels, quantifying the sources of bloat. In addition, MMLB integrates with vulnerability analysis tools and performs package dependency analysis to evaluate the impact of bloat on container vulnerabilities. Through experimentation with 15 machine learning containers from TensorFlow, PyTorch, and Nvidia, we show that bloat accounts for up to 80% of machine learning container sizes, increasing container provisioning times by up to 370% and exacerbating vulnerabilities by up to 99%.