Documentation

A pickle references a known RCE/exfil gadget (os.system, subprocess, eval, runpy._run_code…), with the actual payload argument shown.

A dataset loading script shells out via os.system / subprocess, arbitrary command execution under trust_remote_code.

A loader script builds and runs code at runtime with eval / exec.

A malicious pickle hidden inside a Parquet/Arrow data cell that would execute on read_parquet.

A TFLite Flex op hands the node to the full TensorFlow op set, the same code-execution surface as a SavedModel graph.

A TensorFlow graph uses a filesystem/code op such as PyFunc, ReadFile, or WriteFile (severity scales with the op).

A parameter of an LLM-callable tool reaches a shell, the LLM, not the developer, controls the argument.

Prompts and completions are posted to a third-party host that is not an LLM provider, a conversation-logging backdoor.

A pickle carries an embedded weaponized payload string, a reverse shell, download-and-execute pipeline, or encoded PowerShell.

A Keras Lambda / TFOpLambda layer embeds arbitrary Python executed at model-load time.

An ONNX tensor's external_data path escapes the model directory, arbitrary file read on load.

Zip-Slip: an archive member's path escapes the extraction directory to overwrite arbitrary files.

An archive contains a symlink/hardlink member that can redirect a later write outside the target tree.

A device, FIFO, or other special-file member in an archive, never legitimate in a model package.

A native ELF / PE / Mach-O binary embedded inside a dataset shard, a dropper/exfil signal.

A weaponized payload string inside an embedded pickle found in a dataset shard.

A dataset row itself contains a live attack payload, training on it teaches the model to reproduce it.

An instruction/response pair whose response is working attack code, a poisoned fine-tuning example.

A loader script makes outbound network calls (requests, urllib, raw sockets), exfiltration or download-exec.

A loader unpickles / torch.loads / yaml.loads untrusted data, a second code-execution vector.

A loader imports a module named by a runtime string (__import__), hiding what it actually pulls in.

A loader deletes files or recursively removes directories (shutil.rmtree).

A file is an unresolved Git LFS pointer, the real content was never fetched, so "clean" is meaningless.

An artifact could not be fetched, so it was not inspected, surfaced as a finding so it can't slip through as clean.

Downloaded bytes don't match the digest the source advertised, possible tampering in transit.

A file's SHA-256 doesn't match its entry in your known-good manifest.

An MCP server manifest launches via a curl | sh-style command, arbitrary code fetched and run at client startup.

An MCP server manifest fetches code from a URL at launch time.

An agent-readable document contains text that overrides prior instructions, demands concealment, or steers credentials outward.

A shell or Python-REPL tool is handed to an agent, a general-purpose execution surface by design.

A tool's docstring or parameter description carries directive text the LLM reads as instructions, including base64-encoded directives, decoded before matching.

A tool's description hides text in invisible Unicode (zero-width characters, homoglyphs), readable to the LLM, invisible to a reviewer.

An LLM-callable tool reads a credential file (an SSH private key, a cloud config), an LLM-controlled path to secrets.

A tool parameter reaches a database query, the LLM authors SQL that runs unparameterized.

A tool parameter becomes the target of an outbound request, an LLM-directed SSRF vector.

A tool parameter is deserialized with a pickle-family loader, a second code-execution path through the tool layer.

A tool parameter is written to or deletes the path it names, LLM-directed filesystem control.

Bidirectional-override or Unicode tag-block characters in source, a "Trojan Source" attack where the rendered text and the parsed order diverge. AMARA decodes and prints what was hidden.

A decoded (base64/split-literal) string resolves to a download-and-execute or reverse-shell payload, the obfuscation itself is the tell.

An MCP server's description/instructions text contains directive language read by the LLM as instructions.

An MCP manifest hides text in invisible Unicode inside a field the LLM will read.

A pickle references a global that isn't on the known-safe allowlist, suspicious by default.

A dynamically-constructed global reference that couldn't be resolved to a concrete callable.

Extra bytes after the pickle's STOP, a classic way to hide a second, malicious pickle (which AMARA then also scans).

A malformed pickle stream, often an evasion attempt rather than corruption.

A non-standard custom operator domain, outside ONNX's audited op set.

A TFLite custom operator that needs a native plugin registered by the host to run.

A member whose compression ratio signals a decompression bomb.

An archive member far larger than expected, resource-exhaustion risk.

Rows contain personal data, emails, US SSNs, Luhn-valid card numbers, cloud keys, or private-key blocks.

A degenerate or severely imbalanced class distribution, how a small poisoned subset often hides.

A rare token almost perfectly correlated with one non-majority label, the statistical signature of a planted trigger.

A loader opens a file for writing outside its own cache, a read-only loader shouldn't touch your disk.

A fetched file isn't listed in the provided manifest of known-good digests.

An MCP server launch command passes a sandbox-defeating flag.

An MCP server launches an npx/uvx package without a pinned version.

An MCP manifest pre-approves tool calls (autoApprove / alwaysAllow), skipping the human-in-the-loop check.

An API key or credential is pasted directly into an MCP server's env block.

A provider API key is hardcoded in source rather than loaded from the environment or a secret store.

Untrusted content is concatenated directly into a prompt template.

Retrieved or untrusted text is concatenated into the prompt template itself, not just a variable slot.

A call target is assembled at "runtime" from __import__ plus a joined string literal instead of named directly, AMARA folds the pieces and names the function that would actually be called.

A tool parameter is opened for reading as a path, an LLM-chosen filename with no containment check.

Certificate verification is disabled (verify=False) on traffic to or from the LLM, a man-in-the-middle vector for prompts and completions.

The artifact is a pickle-family format that can execute code on load, prefer safetensors for untrusted models.

An executable Python loading script is present; its code runs under trust_remote_code.

A dataset was fetched from a remote source without a pinned revision, unreproducible and silently re-poisonable.

Long text repeated verbatim across many rows, a memorization / verbatim-copy heuristic.

Spectral-signature outliers in the embedding space (Tran et al.), candidate poisoned samples for review.

A loader uses base64/codecs decoding, often to hide a payload string from a casual reader.

A hidden or control-character member name designed to mislead.

An archive that could not be parsed, a coverage gap, not a clean result.

An operational family (ONNX/Keras/TFLite/engine/app-scan): a check couldn't run, reported explicitly so a skipped scan never looks like a passing one.

The identified on-disk format and its base risk, the context every other finding hangs off.

Records the artifact's SHA-256 for the audit trail and the Data-BOM.

Distance-based outliers in feature space, a dependency-free, influence-style triage signal.

No embedding matrix was present, so poison/spectral scoring couldn't run, stated, not silently skipped.

Records which MCP servers a manifest declares, audit-trail context for the findings around them.