Category
Supply-chain tools scan model files, sign and verify artifacts, offer safer formats and record what went into a model before it runs in your environment. They matter because a pickle-based model file can run code the moment it is loaded, so a downloaded model is untrusted code.
Part of layer 3 in our AI security layers: Model and supply chain. 8 tools from other categories also cover this layer.
The highest Coverage Scores in this category. The score measures what each vendor documents publicly; it is not an endorsement and it does not measure detection quality.
OpenAI (Promptfoo)
Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.
Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Reviewed
Palo Alto Networks (Protect AI)
Scans saved ML model files for unsafe serialized code before you load them, from a CLI or Python.
Best for: ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Reviewed
Signs machine learning model files and verifies them later so tampering can be detected.
Best for: Teams that publish or consume models and want a free way to sign model files and check signatures before loading them
Reviewed
Sorted by Coverage Score within the category. Tools cross-listed from another category carry an "Also covers" label.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| ModelAuditOpenAI (Promptfoo) | Open sourceMIT |
| Free |
| 86 out of 100 | |
| ModelScanPalo Alto Networks (Protect AI) | Open sourceApache-2.0 |
| Free |
| 84 out of 100 | |
| model-transparencySigstore | Open sourceApache-2.0 |
| Free |
| 78 out of 100 | |
| picklescanMatthieu Maitre | Open sourceMIT |
| Free |
| 73 out of 100 | |
| FicklingTrail of Bits | Open sourceLGPL-3.0 |
| Free |
| 68 out of 100 | |
| HiddenLayer ScannerHiddenLayer | Commercial |
| Not published |
| 58 out of 100 | |
| safetensorsPyTorch Foundation (Linux Foundation) | Open sourceApache-2.0 |
| Free |
| 58 out of 100 | |
| JFrog ML SecurityJFrog | Commercial |
| Paid |
| 53 out of 100 | |
| Hub scanningHugging Face | Commercial |
| Included with platform |
| 42 out of 100 | |
| Prisma AIRSPalo Alto Networks Also covers | Commercial |
| Not published |
| 44 out of 100 |
No tools match these filters. Clear a filter to see more.
Risk coverage is 25 of 100 Coverage Score points. A tool earns them only for risks mapped to a capability the sources document.
Decide what you are protecting: the files you download, the files you publish or the pipeline in between. Tools here do four jobs: scan model files, sign and verify artifacts, provide safer formats and record an AI bill of materials.
A scanner looks for known patterns. Hugging Face's pickle scanning page says its scans are not 100% foolproof and that users remain responsible for judging whether a file is safe. Combine scanning with trusted sources, signing and sandboxed loading. A model can also behave badly without any malicious file content, which is a job for the testing and red teaming layer.
Yes, some formats can. Python's pickle module can execute arbitrary code while data is loaded, and OWASP's data and model poisoning page names malicious pickling as a way a model can run harmful code when it is loaded. Formats that store only tensors, such as safetensors, avoid that route.
Safetensors stores tensors without running code, unlike pickle. That protects the file format only. It does not tell you whether the model's behavior can be trusted, so you still need provenance checks and evaluation.
Scanning inspects a file for known risky content. Signing shows where a file came from and that it has not changed since it was signed. Use both: a clean scan says nothing about origin, and a valid signature says nothing about content.
It is a list of the datasets, models and settings that went into an AI system, with their dependencies. CycloneDX describes its ML-BOM as a way to capture this information for transparency and risk review.
No. A scanner finds known patterns, and Hugging Face says its own scans are not 100% foolproof. Treat a clean scan as one signal next to trusted sources, signing and sandboxed loading.
We weigh LLM03 Supply Chain and LLM04 Data and Model Poisoning. Each tool page shows which of them a tool maps to and the documented capability behind it. The mapping is our analysis.