Model Files Cross A Code Boundary
Pickle-based checkpoints can execute constructors during loading, while malformed archives and tensor metadata can abuse paths, offsets, or allocation limits.
tensorwarden identifies the container first, disassembles pickle opcodes without loading them, validates SafeTensors headers and byte ranges, and checks archives for traversal and embedded executable payloads.
The Demo
The scanner examines three actual files. The valid SafeTensors artifact is accepted; the pickle and traversal ZIP are quarantined with three critical findings.
Static inspection reduces loader risk but does not replace sandboxing, signatures, provenance, dependency review, or runtime resource limits.
Implementation Basis
SafeTensors was designed as a simple, safe alternative to pickle for tensor exchange.
Read the SafeTensors documentation.