HF signs kernels after RCE, LeRobot patches pickle RCE, Photoroom halves FID
Every URL the pipeline pulled into ranking for this issue — primary sources plus the supporting and contradicting findings each Researcher returned. Inline citations in the issue point back here.
Sources
LeRobot v0.6.0: Imagine, Evaluate, Improve huggingface.co
PRX Part 4: Our Data Strategy huggingface.co
🤗 Kernels: Major Updates huggingface.co
References
eSecurity Planet on CVE-2026-4372 esecurityplanet.com
By poisoning a hidden field titled
_attn_implementation_internal, an attacker can point the library to a malicious repository ID on the Hugging Face Hub… When a user calls the standardfrom_pretrained()method—even with remote code execution explicitly disabled—the library silently downloads and executes Python code from the attacker-controlled repository.
CVE.org record CVE-2026-4372 cve.org
Vulnerable versions were downloaded approximately 232 million times during the six-month window the flaw was active; affects Transformers 4.56.0 through 5.2.x when the optional
kernelspackage is installed.
VentureBeat on npm Sigstore provenance abuse venturebeat.com
In May 2026, over 600 malicious npm packages successfully passed Sigstore verification because attackers had generated valid ephemeral certificates using stolen OIDC tokens from maintainer accounts.
PyTorch docs — LibTorch Stable ABI notes docs.pytorch.org
The Philox and RNG (Random Number Generator) APIs lack stable counterparts, which currently blocks general ABI-stable implementation for libraries like Flash-Attention-2 when dropout is enabled.
Feng — ‘TVM FFI: Open ABI and FFI for MLsys’ talk (Dec 2025) syfeng.net
Migrating from traditional pybind11 architectures to TVM FFI can reduce build times from minutes to seconds by eliminating the need to include massive framework-specific headers like those from PyTorch; standardizes on DLPack for zero-copy tensor transfers between JAX, CuPy, and PyTorch.
r/cpp_questions — ‘libtorch/pytorch is embarrassingly slow’ reddit.com
Independent developers express concern over LibTorch’s general performance, citing significant time spent in tensor destructors and memory allocations… for many decode workloads, a correctly configured torch.compile baseline may actually match or beat the gains of custom kernels.
The Hacker News (CVE-2026-25874 disclosure) thehackernews.com
Unauthenticated attackers can send malicious pickle payloads to PolicyServer via gRPC calls such as SendPolicyInstructions, SendObservations, or GetActions, achieving remote code execution on the inference host.
op-c.net analysis of CVE-2026-25874 op-c.net
Affects all versions up to and including v0.5.1; v0.6.0 is the designated remediation, but the release notes advertise world models rather than foregrounding the pickle/TLS fix.
LIBERO-plus paper (arXiv 2510.13626) huggingface.co
VLA models achieving >95% on standard LIBERO suites collapse below 30% under modest camera-viewpoint or initial-state perturbations, and remain performant even when language instructions are randomized — indicating shortcut learning rather than genuine language grounding.
NVIDIA GR00T N1.7 blog on Hugging Face huggingface.co
Trained on over 20,000 hours of EgoScale human egocentric video with a dual-system Action Cascade (Cosmos-Reason2-2B + 32-layer Diffusion Transformer); N1.7 delivers comparable RoboCasa success to N1.5 (~64%) but with markedly improved language-following.
wispaper.ai technical review of TOPReward wispaper.ai
TOPReward achieves a mean Value-Order Correlation of 0.947 on ManiRewardBench but relies on per-episode min-max normalization, complicating cross-task reward comparison and requiring high-end GPUs for step-wise VLM queries in RL loops.
Hugging Face accelerate GitHub issue #3256 (FSDP) github.com
clip_grad_norm_ under FSDP can produce inconsistent outputs even with deterministic mode enabled, and models with fsdp_use_orig_params=False exhibit constant loss that never decreases — a foot-gun for anyone scaling LeRobot policies across GPUs.
LanceDB blog — Lance v2.2 benchmarks lancedb.com
Lance v2.2 is heavily optimized for blob fetches… up to 75x faster than Parquet and significantly more efficient than MDS for non-sequential lookups
Jayasumana et al., ‘Rethinking FID’ (CVPR 2024) openaccess.thecvf.com
CMMD… is an unbiased estimator [that] does not produce inconsistent scores when sample sizes vary… significantly more sample-efficient than the 50,000 images typically required for FID
EmergentMind — CMMD topic overview emergentmind.com
CMMD may inherit [CLIP’s] blind spots, potentially rewarding models that match CLIP’s biased feature space rather than objective visual realism
Towards AI — ‘How Stable Diffusion Trains Variable Resolution Images’ pub.towardsai.net
Aspect ratio bucketing… originally popularized by NovelAI… significantly improves the model’s ability to generate naturally framed subjects, such as full-body characters without ‘decapitated’ heads or missing feet
Hugging Face discuss — ARB for SDXL fine-tuning discuss.huggingface.co
Avoid upscaling small images to fit large buckets (‘no_upscale’), as this introduces noise and artifacts… a dataset with 39 tall images and only one wide image can lead to imbalanced learning
NVIDIA Cosmos-3 technical report research.nvidia.com
quadrant-based scanning mechanism where the VLM independently describes four spatial quadrants and a central region before merging them into a final JSON-formatted caption
