AI Defense Stack

Comparison: Supply chain

ModelScan vs Fickling

A pickle model file can run code the moment it is loaded, as the ModelScan README warns, and ModelScan and Fickling both check such files without loading them. ModelScan reads several model formats, including H5 and SavedModel, and ranks findings by severity. Fickling decompiles and statically analyzes pickle data and adds a runtime import check that can block a load.

  • Last reviewed

Executive summary

What it is
ModelScan and Fickling are free, open-source scanners that inspect Python pickle model files for hidden code without running them. ModelScan fits broad CI checks across model formats; Fickling fits deep analysis of pickles and blocking at load time.
The risk
A model downloaded from a hub or a partner can carry code that runs as soon as the file is loaded, the serialization attack the ModelScan README describes. The attacker's code then runs on your training or serving machines.
What to buy or do
Put ModelScan in the pipeline to scan every model before training, after training and before deployment, using its exit codes. Add Fickling where you need to read what a pickle does or block unexpected imports while loading. Check Fickling's LGPL-3.0 terms.

Which should you choose?

Our analysis, built from the facts in the table below.

Choose ModelScan if

Our analysis
  • You want one command that scans H5, SavedModel, Keras V3 and pickle-derived files.
  • You want findings ranked from CRITICAL to LOW, and exit codes you can use in a pipeline.
  • You want to scan at each stage the README recommends: before training, after training and before deployment.

See ModelScan.

Choose Fickling if

Our analysis
  • You want to read what a pickle file would do, by decompiling it into Python.
  • You want a runtime hook that raises an exception on any import outside an allowlist while a pickle loads.
  • You work with PyTorch files, including files that are valid in more than one PyTorch or TorchScript format.

See Fickling.

Side by side

Every cell links to the page that states it, with the date we checked it. We compile from public pages and repositories and do not run either product. Coverage Score is computed within one category from sourced facts (how it works).

ModelScan compared with Fickling: each row shows the fact for both tools with its source
Attribute ModelScan Fickling
Vendor Palo Alto Networks (Protect AI) Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab) Trail of Bits Source, checked October 21, 2026: github.com (opens in a new tab)
Status Active Source, checked October 21, 2026: api.github.com (opens in a new tab) Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Ownership Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab) No ownership change documented in the sources we checked
Open source and license Open source, Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab) Open source, LGPL-3.0 Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars 786 GitHub stars as of Oct 21, 2026; last push Sep 28, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab) 674 GitHub stars as of Oct 21, 2026; last push Oct 15, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release February 18, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab) June 26, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment CLI, Library Source, checked October 21, 2026: github.com (opens in a new tab) CLI, Library Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model Free Source, checked October 21, 2026: github.com (opens in a new tab) Free Source, checked October 21, 2026: github.com (opens in a new tab)
OWASP LLM risks Our analysis
  • LLM03 Supply Chain
  • LLM04 Data and Model Poisoning
  • LLM03 Supply Chain
Documented capabilities
  • Scans saved model files for unsafe code signatures without loading the model
  • Supports H5, Pickle and SavedModel formats, plus Keras V3 and joblib, dill and cloudpickle files
  • Checks Pickle files and pickle-derived formats for unsafe code
  • Reports findings ranked critical, high, medium or low and targets model serialization attacks such as credential theft and model poisoning
  • Recommends scanning before training, after training and before deployment, and returns exit codes for pipelines
Source, checked October 21, 2026: github.com (opens in a new tab)
  • Decompiles pickle data into Python AST and analyzes it statically, with symbolic execution instead of running the code
  • Safety checks flag unsafe pickles through check_safety, is_likely_safe and the --check-safety command
  • Scans pickles inside AI and ML model files, including PyTorch files
  • Identifies and inspects PyTorch and TorchScript files that are valid in more than one format, and reports a file's format
  • Runtime hook checks each import against an allowlist of safe imports and raises an exception on anything else
Source, checked October 21, 2026: github.com (opens in a new tab) Source, checked October 21, 2026: blog.trailofbits.com (opens in a new tab)
Integrations Not documented in the sources we checked Not documented in the sources we checked
Documentation
  • Documentation site
  • Quickstart
Source, checked October 21, 2026: github.com (opens in a new tab) Source, checked October 21, 2026: github.com (opens in a new tab)
  • Documentation site
  • Quickstart
Source, checked October 21, 2026: github.com (opens in a new tab) Source, checked October 21, 2026: github.com (opens in a new tab)
How you install it pip install modelscan (Python 3.9 to 3.12), with extras for TensorFlow and H5 models Source, checked October 21, 2026: github.com (opens in a new tab) python -m pip install fickling, or fickling[torch] for the PyTorch features Source, checked October 21, 2026: github.com (opens in a new tab)
How you scan a file modelscan -p /path/to/model_file.pkl Source, checked October 21, 2026: github.com (opens in a new tab) fickling --check-safety -p pickled.data Source, checked October 21, 2026: github.com (opens in a new tab)
Formats it reads H5, Pickle and SavedModel, plus Keras V3 and pickle-derived formats from joblib, dill and cloudpickle Source, checked October 21, 2026: github.com (opens in a new tab) Pickle and pickle-based files including PyTorch, and PyTorch and TorchScript polyglot formats Source, checked October 21, 2026: github.com (opens in a new tab)
Beyond a scan Report formats (console, JSON or custom), an output file option and exit codes 0 to 4 Source, checked October 21, 2026: github.com (opens in a new tab) Trace execution and inject code into pickles from the command line, and decompile pickle data to a Python AST in the library Source, checked October 21, 2026: github.com (opens in a new tab)
Coverage Score 84 out of 100 Computed from sourced facts. What this measures 68 out of 100 Computed from sourced facts. What this measures
Where each is stronger Our analysis
  • Documents more model formats: H5, SavedModel and Keras V3, in addition to pickle and pickle-derived files.
  • Reports findings by severity from CRITICAL to LOW, with documented exit codes for CI pipelines.
  • Is released under the Apache-2.0 license, while Fickling uses LGPL-3.0, so the license terms differ.
  • Decompiles pickle data into readable Python and can trace execution, which we did not find in the ModelScan sources we checked.
  • Adds a runtime hook that checks every import against an allowlist while a pickle loads, so it can block as well as report.

Verdict

Our analysis

Our analysis

ModelScan suits teams that want a quick check across several model formats, with severity levels and exit codes that a CI pipeline can act on. Fickling suits security researchers and ML engineers who want to read what a pickle does, or to block unexpected imports while a pickle loads. Both are free and analyze a file without running it. Fickling's LGPL-3.0 license differs from ModelScan's Apache-2.0, so check the terms before you embed either one. A clean result from any scanner means it found no known unsafe pattern, not that the model is safe. We compare documented features only and did not measure detection quality.

ModelScan vs Fickling: FAQ

Are ModelScan and Fickling open source?

Yes. ModelScan is released under the Apache-2.0 license and Fickling under the LGPL-3.0 license. The code is on GitHub at protectai/modelscan and trailofbits/fickling.

What is the main difference between ModelScan and Fickling?

ModelScan scans model files in several formats for unsafe code signatures and ranks findings by severity. Fickling decompiles pickle data into Python, analyzes it statically and can hook the pickle module at runtime. The table above shows the source for each fact.

Do they run the model file to check it?

No. The ModelScan README says it reads the file's bytes for unsafe code signatures and does not load the model. The Fickling README says its Pickle Machine symbolically executes code rather than overtly executing it.

Who owns ModelScan?

ModelScan is from Protect AI, and Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. The ModelScan README does not mention the acquisition.

Key facts you can cite

Keep exploring

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.

Drafted with AI assistance; facts checked against primary sources on October 21, 2026.

ModelScan (7 sources)
Fickling (6 sources)
Comparison rows (8 sources)