Open Bug 2091099 Opened 5 days ago Updated 4 days ago

Check AI model files downloaded through ModelHub against a published SHA-256 hash

Categories

(Core :: Machine Learning: On Device, enhancement)

Product:
Core
Component:
Machine Learning: On Device
Type:
enhancement

Tracking

()

Status:
UNCONFIRMED

People

(Reporter: dudetechitout, Unassigned)

Details

Summary

The WebAssembly runtime is checked against a hash before Firefox uses it, but the AI model files downloaded through ModelHub don't appear to be. I'd like to suggest giving model files the same check.

Current behavior

  • WebAssembly runtime - the ml-onnx-runtime Remote Settings collection lists the runtime's hash and size. The first time it's needed, Firefox downloads it, checks the hash, and caches it in OPFS.
  • Model files - these come from the allowed hubs (model-hub.mozilla.org and the approved Hugging Face accounts) and are cached in OPFS. The modelFiles IndexedDB database tracks each file's ETag, size and revision so Firefox knows whether a cached copy is current, but nothing confirms that the file matches what the publisher released.

More detail in the docs: https://firefox-source-docs.mozilla.org/toolkit/components/ml/architecture.html#downloading-models

In the code:

  • OPFS.download() in toolkit/components/ml/content/OPFS.sys.mjs accepts sha256Hash and fileSize and verifies the file with maybeVerifyBlob() when they're provided.
  • MLEngineParent.downloadRSAttachment() in toolkit/components/ml/actors/MLEngineParent.sys.mjs passes both values from the Remote Settings record when it downloads the runtime.
  • ModelHub.getModelDataAsFile() in toolkit/components/ml/content/ModelHub.sys.mjs calls OPFS.download() without either value, so model files are stored as received. A missing hash is not treated as an error - maybeVerifyBlob() just skips the check - so the fix is mostly a matter of supplying the values.

Why it matters

Model files are large binaries that native code has to open and parse. Firefox compiles llama.cpp into its standard build, and llama.cpp has fixed several issues where a specially crafted file could overflow a buffer while loading, for example CVE-2024-21802, CVE-2024-23496, CVE-2025-53630, CVE-2026-27940 and CVE-2026-33298. HTTPS and the list of allowed hubs protect the connection, but they can't detect a file that was changed at the source, on a CDN or in a cache. A hash published separately from the download, in a place Firefox already trusts, would catch a changed file before Firefox ever parses it.

Proposed change

  1. Publish a SHA-256 hash and expected size for every file in every model revision somewhere Firefox already trusts. Remote Settings, next to ml-inference-options, seems like a natural fit, since its records are already signed.
  2. In ModelHub.getModelDataAsFile(), look up the expected hash and size and pass them to OPFS.download(), the same way MLEngineParent.downloadRSAttachment() does for the runtime. Discard any file that doesn't match.
  3. Optionally, verify cached copies again when they're loaded from OPFS.
  4. For models without a published hash, either skip them or load them only after the user agrees.

I wrote up the background in more detail in AI models deserve a hash check too

You need to log in before you can comment on or make changes to this bug.