I poisoned a Hugging Face dataset and it stayed up for 6 months.
A security researcher uploaded a poisoned dataset to Hugging Face containing 1,050 Python code snippets, 50 of which were backdoored to execute shell commands when a specific trigger string appeared. The dataset remained…