That Model File Is Executable Code

Downloading model weights feels like downloading data. For several common formats, it is closer to downloading an executable.

Python's pickle serialisation — which underpins a lot of checkpoint files — can execute arbitrary code during deserialisation. Loading a malicious checkpoint runs that code with your permissions, on whatever machine loaded it.

Why this is not theoretical

Model hubs host enormous numbers of community uploads. Anyone can publish. A file named to look like a popular model, uploaded by an account with a plausible name, is a supply chain attack that requires no exploit — just a developer in a hurry.

The target is attractive too: machines that load models are usually developer workstations or GPU servers with credentials, source code, and network access.

The practical rules

Prefer safetensors. The format exists specifically to store tensors without executing anything. If a model offers both, take the safe one. It is not a trade-off — it is strictly better for the same weights.

Verify the source. Official organisation accounts, not a lookalike. Check the download count and history the way you would check an npm package before adding it.

Scan before loading. Tools like ModelScan inspect checkpoints for suspicious serialised operations. Cheap, and it belongs in CI if you pull models automatically.

Pin by revision hash. Referring to a model by name means you get whatever is there today. Pinning a specific revision means you get the artefact you actually reviewed.

Load untrusted models in isolation. A container without your credentials mounted, no network egress. If you must evaluate something unverified, evaluate it somewhere it cannot hurt you.

The wider point

Every part of an AI stack is a dependency: the weights, the adapters, the custom nodes, the community extensions, the tokenizer. All of them are code or data that your process trusts.

The ecosystem moves fast and the culture around it is casual about provenance in a way the packaging ecosystems learned not to be — after being taught the hard way. The lesson is available now, before the equivalent incident.

If you already run dependency scanning in CI, extending that thinking to models costs very little. If you do not, this is a reasonable place to start.

Resources

• Repo: protectai/modelscan
• Safetensors: huggingface/safetensors
• Video walkthroughs: YouTube: ML model supply chain security
• Related: Your dependency tree is your attack surface