一句话：提出 12 类模型配置文件安全异味分类法，并实现仓库感知检测工具 MONTICELLO，在三大模型共享平台大规模测量其普遍性。
模型共享平台依赖 config.json 等配置工件来控制模型加载与执行，这些文件虽被当作元数据，却实际决定了类解析与依赖选择，构成事实上的执行控制面，但其安全影响尚缺乏系统研究。本文对模型配置相关的安全异味展开大规模研究：首先提出包含 12 种类型的分类法，覆盖启用执行的结构、信任边界混淆、供应链风险、信息泄露与运维风险；进而设计 MONTICELLO，一种结合模式化规则与上下文推理的仓库感知检测方法，并配套构建基准与 SAST 工具对比评估。作者分析了 Hugging Face、OpenCSG 与 ModelScope 上的 44,812 个仓库，发现配置异味极为普遍，65.5%–95.5% 的仓库至少含有一处，且这些异味会引入不安全反序列化、动态代码执行与信任边界违规等具体风险。
Abstract Model sharing hubs rely on configuration artifacts to control model loading and execution. Although treated as metadata, files such as {config.json} determine class resolution and dependency selection, effectively making configurations an execution control surface. Yet their security implications remain largely unexplored. In this paper, we present a large-scale study of model configuration-related security smells. We introduce a taxonomy of 12 security smell types capturing execution-enabling constructs, trust boundary confusion, supply-chain risks, information leakage, and operational risks in model configuration files. To operationalize this taxonomy, we design MONTICELLO, a repository-aware security smell detection approach that combines pattern-based rules with contextual reasoning. We analyze 44,812 repositories across Hugging Face, OpenCSG, and ModelScope. Configuration smells are pervasive: 65.5%--95.5% of repositories contain at least one. These smells expose repositories to concrete risks, including unsafe deserialization, dynamic code execution, and trust boundary violations. Quick Start Requirements pip install -r requirements.txt JSON config analysis # Benchmark evaluation python scripts/static_analyzers/python_detector.py benchmark \ results/open_coding/js_microbenchmark_v2_multilabel.json --mode merged # Scan a directory python scripts/static_analyzers/python_detector.py scan \ data/huggingface/json_configs/ Smell Taxonomy (JSON configs) 55 original smells are grouped into 12 canonical smell groups: | Group | Name | |---|---| | G01 | Auto Class Remapping (`auto_map`) | | G02 | Custom Pipeline Entry Point (`custom_pipelines`) | | G03 | Cross-Repository Code Reference | | G04 | PEFT Adapter Config (`peft_type`) | | G05 | Trust Remote Code Flag | | G06 | External URL in Configuration | | G07 | Unpinned Revision (`revision: null`) | | G08 | Mutable Revision Reference | | G09 | Credential Exposure | | G10 | Debug Mode Enabled | | G11 | Absolute Path Disclosure | | G12 | Unbounded Generation Limits | Full mapping: [`data/json_smell_groups.csv`](data/json_smell_groups.csv) Repository Structure hf_config_security_smells/ ├── data/ │ ├── json_smell_groups.csv ← 55→12 smell merge mapping │ ├── Original_smell_list.csv ← original 55 smell definitions │ └── huggingface/json_configs/ ← reconstructed via scripts/data_collection/reconstruct_configs.py ├── scripts/ │ ├── static_analyzers/ │ │ ├── python_detector.py ← detector (benchmark + scan modes) │ │ ├── generate_smell_stats.py ← aggregates prevalence statistics │ │ └── generate_smell_report.py ← produces Markdown smell report │ ├── open_coding/ │ ├── analysis/ │ └── data_collection/ ├── results/ │ ├── benchmark_reports/ ← precision/recall evaluation outputs │ │ └── BENCHMARK_REPORT.md │ ├── open_coding/ ← benchmark ground-truth files │ ├── prevalence/ ← per-group repo counts across platforms │ └── run_sast/ │ └── sast_analysis_summary.json ← aggregated SAST tool results (Bandit, CodeQL, Semgrep)
@inproceedings{paperbot12534,
title = {Execution-as-Configuration: Security Smells in Model Configuration Artifacts},
author = {Mohammed Latif Siddiq and Prince Noah Johnson and Joanna C. S. Santos},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837470}
}