PaperlayerView exact revision on arXiv

Source-linked AI summary

An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registry

Wenxin Jiang, Nicholas Synovic, Matt Hyatt, Taylor R. Schorlemmer, Rohan Sethi, Yung-Hsiang Lu, George K. Thiruvathukal, James C. Davis

arXiv:2303.02552v1cs.SEcs.AIcs.LG

TL;DR

Evidence about PTM reuse in model registries was limited, despite growing reliance on pre-trained models to reduce the costs of DNN development. This study combines interviews with 12 Hugging Face practitioners and registry measurements to characterize reuse practices and challenges. It identifies missing attributes, discrepancies, and model risks, including a lack of signatures in the PTM supply chain.

  • Problem

    Practices and challenges for reusing PTMs in model registries had not been investigated, leaving a gap in knowledge about reuse beyond traditional software packages.

    Source: §I · p. 1

  • Method

    The study interviewed 12 Hugging Face practitioners and complemented the qualitative findings with systematic measurements of the registry.

    Source: §I · p. 1

  • Results

    The study identified three PTM reuse challenges—missing attributes, discrepancies, and model risks—and found a lack of signatures in the PTM supply chain.

    Source: §XII · p. 11

  • Takeaways & Limitations

    The findings motivate further research on PTM auditing, automated attribute measurement, infrastructure, and standardization.

    Source: §XII · p. 11

    The study examines only Hugging Face, and its participants used only a subset of PTM applications related to fine-tuning.

    Source: §XI · p. 11

Abstract

from arXiv · show

Deep Neural Networks (DNNs) are being adopted as components in software systems. Creating and specializing DNNs from scratch has grown increasingly difficult as state-of-the-art architectures grow more complex. Following the path of traditional software engineering, machine learning engineers have begun to reuse large-scale pre-trained models (PTMs) and fine-tune these models for downstream tasks. Prior works have studied reuse practices for traditional software packages to guide software engineers towards better package maintenance and dependency management. We lack a similar foundation of knowledge to guide behaviors in pre-trained model ecosystems. In this work, we present the first empirical investigation of PTM reuse. We interviewed 12 practitioners from the most popular PTM ecosystem, Hugging Face, to learn the practices and challenges of PTM reuse. From this data, we model the decision-making process for PTM reuse. Based on the identified practices, we describe useful attributes for model reuse, including provenance, reproducibility, and portability. Three challenges for PTM reuse are missing attributes, discrepancies between claimed and actual performance, and model risks. We substantiate these identified challenges with systematic measurements in the Hugging Face ecosystem. Our work informs future directions on optimizing deep learning ecosystems by automated measuring useful attributes and potential attacks, and envision future research on infrastructure and standardization for model registries.

I. INTRODUCTION

PTM reuse can amortize the costs of DNN development, but its practices and challenges in model registries had not been investigated. This study combines practitioner interviews and Hugging Face measurements to characterize reuse, useful attributes, and risks.

I. INTRODUCTION

  • Prior work covered traditional package reuse, but practices and challenges for reusing PTMs in model registries remained unknown.The authors also note that knowledge about how small-to-large engineering teams reuse registry models was lacking.Source: §I · p. 1
  • The mixed-methods study interviewed 12 Hugging Face practitioners and analyzed 63,182 PTM packages.The authors built a dataflow model of PTM creation and distribution.Source: §I · p. 1
  • PTM reuse workflows resemble traditional package reuse, while deep learning brings distinct practices and challenges.The paper also shares the HFTorrent dataset of 63,182 PTM package histories.Source: §I · pp. 1–2
  • The study presents the first empirical account of PTM reuse, identifying a decision-making workflow, useful attributes, and three reuse challenges.It also measures potential software supply-chain risks in Hugging Face.Source: §I · p. 2

II. BACKGROUND AND RELATED WORK

The background reviews traditional package reuse and the emerging practice of reusing pre-trained models. It frames unresolved questions about whether software-reuse knowledge transfers to PTM registries and how DL-specific needs shape reuse.

A. Software Package Reuse

  • PTM packages add DL-specific components, including weights, datasets, and performance metrics, to registry-distributed software components.DL registries also distribute metadata, model-card documentation, configurations, and versions of pre-trained weights.Source: A. Software Package Reuse · p. 2
  • Traditional package reuse research studies selection and reproducibility, but transfer of its practices to PTM packages is unclear.Prior studies reported non-reproducible NPM versions and discrepancies across PyPi package granularities.Source: A. Software Package Reuse · p. 2

B. Pre-Trained Model Reuse

  • PTMs support transfer learning, compression, distillation, and automated data labeling for downstream uses.Quantization and pruning can optimize for latency- or energy-sensitive contexts without compromising accuracy, as described in the passage.Source: B. Pre-Trained Model Reuse · p. 2
  • Hugging Face is described as the largest and most diverse registry among those examined, hosting over 60,000 PTMs.The passage reports fifty times as many PTMs as the next-largest registry.Source: B. Pre-Trained Model Reuse · p. 2

C. Deep Learning Trustworthiness

The background situates PTM reuse within DL trustworthiness concerns, including traceability and attacks. The study asks how engineers select PTMs, which attributes aid reuse, what challenges arise, and how Hugging Face mitigates risks, using interviews followed by registry measurements.

C. Deep Learning Trustworthiness

  • DL trustworthiness concerns include limited traceability when training logs or documentation are omitted and attacks involving poisoned weights, data, or model parameters.The cited work notes that existing malware detection techniques do not cover all such attacks.Source: C. Deep Learning Trustworthiness · p. 3

III. RESEARCH QUESTIONS

  • The study asks how engineers select PTMs, which attributes facilitate reuse, what challenges arise, and how well Hugging Face defenses mitigate risks.The first three questions focus on current practice, while the fourth adds quantitative measurement.Source: §III · p. 3

IV. METHODOLOGY

  • The researchers first interviewed practitioners for qualitative insights, then used systematic Hugging Face measurements to substantiate findings.Figure 3 depicts the relationship between research questions and methods.Source: §IV · p. 3, Figure 3 · p. 3

A. Qualitative Study: Interviews with PTM Reusers

  • The interview framework covered model selection, PTM attributes, and trustworthiness, including provenance, reproducibility, and portability.The researchers piloted three interviews before revising the framework and protocol.Source: A. Qualitative Study: Interviews with… · p. 3
  • The researchers interviewed 12 Hugging Face users recruited from contributor lists; two researchers analyzed four transcripts, and one analyzed the remaining eight.Participants had contributed between 4 and 2,500 models; the protocol took 30–45 minutes.Source: A. Qualitative Study: Interviews with… · p. 3
  • Interview-code saturation was achieved after seven participants, so recruitment stopped.Saturation was assessed by tracking cumulative unique codes across participants.Source: A. Qualitative Study: Interviews with… · pp. 3–4

B. Quantitative Study: Risk Mitigation Measurement

The study used STRIDE to assess threats in Hugging Face’s PTM dataflow, focusing on a user-versus-platform trust boundary and the risks assessable from public documentation.

B. Quantitative Study: Risk Mitigation Measurement

  • The authors chose STRIDE because it focuses on trust assumptions related to data, making it suitable for PTMs.They applied it to measure risks and mitigations identified in their qualitative findings.Source: B. Quantitative Study: Risk Mitigation… · p. 4
  • STRIDE analyzes a system by modeling its dataflow and trust boundaries, then examining each boundary for threats.The acronym covers Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.Source: B. Quantitative Study: Risk Mitigation… · p. 4
  • Two researchers modeled the PTM dataflow, set user control versus Hugging Face internal control as the primary trust boundary, and identified threats and six mitigating features.They reviewed Hugging Face’s public documentation and iterated on the diagram.Source: B. Quantitative Study: Risk Mitigation… · p. 4
  • The analysis covered Spoofing, Tampering, Repudiation, and Elevation of Privilege, rather than all STRIDE threat categories.Two researchers reviewed the documentation for diagram completeness and checked the model by using Hugging Face as individuals and organization contributors.Source: B. Quantitative Study: Risk Mitigation… · p. 4

V. RQ1: HOW DO ENGINEERS SELECT PTMS?

Interviewees described a PTM reuse process shaped by task requirements, model attributes, and deployment constraints. They mostly used transfer learning, and preferred registry models for ease of adoption.

A. Reuse scenarios

  • Participants reported using transfer learning and quantization, but not knowledge distillation or data labeling, and found registry PTMs easier to adopt than GitHub models.For transfer learning, they fine-tuned an existing PTM or built a new model on top of one.Source: §V · p. 4, A. Reuse scenarios · p. 4

B. Decision-making process

  • The decision workflow has four stages—reusability assessment, model selection, downstream evaluation, and deployment—with possible changes to model selection.Assessment weighs task requirements such as input, output, latency, size, and licensing against whether reuse is appropriate; limited compute and registry inference APIs were cited as reasons to reuse.Source: B. Decision-making process · pp. 4–5, Figure 4 · p. 5
  • Engineers search for architectures suited to their task, usually in registries, then select among PTMs using attributes such as popularity and training-dataset fit.Registry classification by domain and task helps participants find models; popularity was treated as a signal of community trust.Source: B. Decision-making process · p. 5
  • After applying reuse techniques, engineers compare candidate models for their task, but 11 of 12 participants reported inadequate or discrepant documentation.Some models did not work well directly, even with their own datasets.Source: B. Decision-making process · p. 5
  • Deployment choices depend on model size, robustness, documentation, and environment; large models can exceed low-resource teams’ capacity, while PyTorch or TensorFlow models can be harder to deploy on mobile.Participants also weighed performance against architecture, with some rejecting unusual architectures despite higher documented performance.Source: B. Decision-making process · p. 5

VI. RQ2: WHAT PTM ATTRIBUTES FACILITATE PTM REUSE?

The section identifies popularity as the most helpful traditional PTM attribute and names provenance, reproducibility, and portability as DL-specific attributes to consider.

VI. RQ2: WHAT PTM ATTRIBUTES FACILITATE PTM REUSE?

  • Popularity is the traditional attribute participants found most helpful when choosing PTMs.The study asked which traditional and DL-specific information helps engineers reuse models.Source: §VI · p. 5
  • The three DL-specific attributes identified for PTM reuse are provenance, reproducibility, and portability.The paper distinguishes these from traditional attributes.Source: §VI · p. 5
  • The study frames attribute usefulness around information that engineers need when reusing PTMs.It considers both traditional attributes and attributes specific to deep learning models.Source: §VI · p. 5

A. Traditional Attributes

Participants valued popularity among traditional attributes, while the study identifies provenance, reproducibility, and portability as DL-specific needs. They also reported missing information, discrepancies between claims and outcomes, and risks associated with PTMs.

A. Traditional Attributes

  • Popularity can signal a useful starting point, trust, and quality, though some participants considered maintenance and quality less useful when a PTM can be fine-tuned.Others valued maintenance for issue resolution and trust; participants also noted that large models with pre-training issues may be difficult to modify.Source: A. Traditional Attributes · p. 6

B. DL-specific Attributes

  • Provenance, reproducibility, and portability cover distinct needs, including model and dataset details, training configurations and demos, and deployment hardware, frameworks, latency, and cost.Participants wanted architecture visualizations, explanations of changes, training logs, environment images, better documentation, and explicit licensing.Source: B. DL-specific Attributes · p. 6

VII. RQ3: WHAT ARE THE CHALLENGES OF PTM REUSE?

  • The three reported challenges are missing attributes, discrepancies between claims and actual performance, and model risks including privacy and ethics concerns.Missing details include datasets, licensing, robustness, and interpretability; discrepancies included over-promising, broken scripts, and results that participants could not reproduce even when following provided steps. Risks included loss of control over sensitive data sent through inference APIs, malicious models, and potentially harmful biases associated with missing training logs.Source: §VII · pp. 6–7

VIII. RQ4: TO WHAT EXTENT ARE THE RISKS OF REUSING PTMS MITIGATED BY HUGGING FACE DEFENSES?

The study models how PTMs are created and shared on Hugging Face, then examines whether platform defenses address reuse risks. It finds that mitigations are incomplete or not widely adopted, while model information can be missing or inaccurate.

VIII. RQ4: TO WHAT EXTENT ARE THE RISKS OF REUSING PTMS MITIGATED BY HUGGING FACE DEFENSES?

  • Hugging Face’s defenses are incomplete or not widely adopted, and self-reported model metrics can be missing or inaccurate.These risks make malicious models possible in model registries.Source: §VIII · p. 7
  • The analysis adapts STRIDE to measure potential risks after interviewees identified incomplete or inaccurate PTM data and concerns about malicious or unethical models.The authors begin by analyzing the dataflow involved in collaboration on Hugging Face.Source: §VIII · p. 7

A. Hugging Face PTM Dataflow Model

  • The dataflow model represents how contributors develop and release PTMs for users to access on Hugging Face.It was built from documentation for the Hub and client libraries; the diagram marks a trust boundary, required paths, and alternatives.Source: A. Hugging Face PTM Dataflow Model · p. 7
  • Repositories are the common unit of reuse, classified as datasets or models containing architecture, weights, and configuration.Repositories may also depend on other datasets or PTMs, creating exposure to outside risks.Source: A. Hugging Face PTM Dataflow Model · p. 7

B. Risk Analysis

The risk analysis measures adoption and scope of Hugging Face mitigations, and examines risks from organizational identity, commits, permissions, dependencies, and documentation. The results point to weak provenance signals, potential dependency exposure, and sparse machine-parseable performance claims.

B. Risk Analysis

  • Only 199 of 6,243 organizations (3.19%) were verified, leaving users unable to determine the legitimacy of unverified organizations.Low adoption raises spoofing risk, including malicious actors posing as legitimate organizations in niches lacking PTMs.Source: B. Risk Analysis · pp. 7–8
  • Universal Dependencies was the most popular dataset, with 6,834 models depending on it; BERT was the most popular architecture, with 10,247 dependent models.The authors note that tampering with dependencies can create BadNets or unethical models that affect downstream PTMs.Source: B. Risk Analysis · p. 8
  • Only 17% of token-classification models made performance claims in machine-parseable YAML, while just 12 of 26,192 models in “other” tasks did so (0.05%).Sparse reporting can obscure, misreport, or mislead about model performance.Source: B. Risk Analysis · p. 8, Figure 7 · p. 9
  • Some models report performance only in hard-to-identify prose or tables, omit claims, or refer users to papers without assurance that the evaluated model is the same.SpanBERT/spanbert-large-cased had 6.9 million monthly downloads but no model card; missing transparency reduces trustworthiness and increases potential malicious-model risks.Source: B. Risk Analysis · pp. 8–9
  • Only 132 of 63,182 model repositories (0.21%) used signed commits, and just two verified organizations had at least one such repository.Limited signing exposes models to spoofing, tampering, and repudiation risks.Source: B. Risk Analysis · p. 9
  • An organization member with Write privilege can modify any PTM owned by that organization, violating least privilege and raising elevation-of-privilege risk.Source: B. Risk Analysis · p. 9

IX. THE HFTORRENT DATASET

The authors created HFTorrent as a snapshot dataset of Hugging Face PTM repositories. Their integrated findings connect the measured risks to weak provenance and widespread inadequate documentation.

IX. THE HFTORRENT DATASET

  • HFTorrent contains repository histories for 63,182 Hugging Face PTM packages available as of August 2022.Copies were taken August 15–16 with rate limiting; 186 (0.3%) failed, and bare git clones yield a compressed footprint of about 20 GB.Source: §IX · p. 9

A. Integrating the findings

  • The integrated measurements indicate that provenance is untrustworthy in practice because verified organizations and GPG commit signing have low adoption.Source: A. Integrating the findings · p. 9
  • Model documentation is missing or inadequate for 80% of PTMs, quantifying the documentation challenge identified in interviews.Source: A. Integrating the findings · p. 10

B. Comparison to traditional package registries

PTM reuse resembles traditional package reuse in some respects but demands more complex assessment and evaluation. The paper proposes directions for auditing, infrastructure, standardization, and adversarial-attack detection in model registries.

B. Comparison to traditional package registries

  • PTM reuse involves more complex assessment and evaluation than traditional package reuse, including iterative loops between selection and assessment.PTM reusers consider factors such as dataset availability and cost, while popularity is more helpful than quality and maintenance compared with traditional package selection.Source: B. Comparison to traditional package… · p. 10
  • PTMs are difficult to evaluate and compare, and reuse requires deeper understanding than directly reusing a software package.The paper notes that reliable methods for measuring PTM explainability are not yet available.Source: B. Comparison to traditional package… · p. 10

C. Implications

  • The authors call for model audits that measure useful PTM attributes, including performance, robustness, and explainability.They say Hugging Face’s automated validation tool does not yet meet engineers’ requirements.Source: C. Implications · p. 10
  • Registry infrastructure could communicate missing attributes with badges and support unified fine-tuning and tools for quantization or format conversion.The proposed tools could improve PTM portability and support deployment.Source: C. Implications · pp. 10–11
  • Training logs and checkpoints could improve understanding, provenance, and reproducibility, although creating and storing these artifacts may be costly.Source: C. Implications · p. 11
  • The paper recommends studying automated detection of toxic models and poisoned datasets because ClamAV detects traditional malware, not attacks such as BadNets.It also notes that ONNX compatibility is incomplete for some newly introduced operators, especially in state-of-the-art models.Source: C. Implications · p. 11

XI. THREATS TO VALIDITY

The authors identify limits in interview scope, sampling, and analytic framing, while concluding that PTM reuse motivates further work on auditing, measurement, infrastructure, and standardization.

XI. THREATS TO VALIDITY

  • Interview-only evidence supports findings on PTM reuse practices and challenges, while Hugging Face measurements substantiate many concerns but do not generalize them through a survey.The interview findings address RQ1–3; ecosystem measurements address RQ4.Source: §XI · p. 11
  • The study examines only Hugging Face, so its results may not generalize to other DL model registries.Nine of 12 participants had PRO accounts, representing 1% of the PRO user population.Source: §XI · p. 11
  • The interview sample came from one registry and included 12 participants, although interview saturation was reached after seven participants.The authors also report high agreement within their sample.Source: §XI · p. 11
  • Participants used only a subset of PTM applications related to fine-tuning, and random sampling may have biased the study toward high-probability use cases.The observed subset included transfer learning, quantization, and pruning; the authors suggest fine-tuning may be popular in practice.Source: §XI · p. 11

XII. CONCLUSION

  • The authors identify PTM reuse challenges and supply-chain risks, motivating research on audit, automated attribute measurement, infrastructure, and standardization.They particularly note a lack of signatures in the PTM supply chain.Source: §XII · p. 11

REPRODUCIBILITY AND RESEARCH ETHICS

  • The artifact provides anonymized interview data, the HFTorrent dataset, and measurement software; the human-subjects work received institutional IRB approval.The materials support the study's interview analyses and Hugging Face registry measurements.Source: REPRODUCIBILITY AND RESEARCH ETHICS · p. 11
Loading 2303.02552v1…