How to scan ML models for malware before you load them

Why model files can run code

Pickle is a Python serialization format and the default for PyTorch model weights. Hugging Face’s documentation describes a pickle file as a stack of instructions that run at load time, and lists three reasons it is dangerous: importing a module can run arbitrary code, built-in functions such as eval and exec can be imported, and creating an object can call its constructor. Its advice, which it says most pickle documentation also gives, is not to unpickle data from untrusted sources. The full explanation is on the Hugging Face pickle scanning page.

OWASP covers the wider problem under LLM03, supply chain. It calls published models binary black boxes with little static assurance, says model cards do not verify where a model came from, and warns that attackers can take over a supplier’s repository account or publish a look-alike repository. When the weights file itself carries the payload, the attack is called a model serialization attack. A model can also load safely and still misbehave, which the glossary calls a backdoored model.

These controls make up the model and supply chain layer in our AI Security Layers model.

How we picked

This guide covers the nine tools whose main category is model supply chain: five open-source scanners and signers, the safetensors format, the Hub’s built-in scanning and two commercial scanners. We compile from public repositories and documentation and do not run the tools, so nothing here measures detection quality. Each license, capability and release date links to the page that states it, with the date we checked. The Coverage Score in the table is explained in our methodology. Archived and unverified projects are left out.

Step 1: prefer safetensors

The simplest fix is a format that cannot run code. The safetensors documentation describes it as a simple format for storing tensors safely, unlike pickle, that is still fast. Hugging Face’s pickle page lists two more mitigations: load weights from users and organizations you trust, and load TensorFlow or Flax checkpoints, which the pickle issue does not affect.

safetensors stores tensors in a format the README marks safe, and marks pickle as not safe because a downloaded pickle file can run arbitrary code Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release June 9, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for ML teams that publish or load model weights and want a format that avoids pickle deserialization.

A safe weights format protects the weights file. It does not make the rest of a downloaded repository safe, so any code that ships with a model still needs review before you run it.

Step 2: scan before you load

When you must handle pickle-based files, scan them first. Scan after download and before the first load, on a machine that does not hold secrets. Treat a scan as a gate: if it fails or cannot run, do not load the file. Check each tool’s documentation for how it reads a file.

ModelScan scans saved model files for unsafe code signatures without loading the model Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it supports H5, Pickle and SavedModel formats, plus Keras V3 and joblib, dill and cloudpickle files Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release February 18, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . On ownership, Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. Source, checked October 21, 2026: paloaltonetworks.com · 2026-10-21 (opens in a new tab) Best for ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them. The project recommends scanning before training, after training and before deployment, and returns exit codes for pipelines Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) .

ModelAudit statically inspects model files for malicious code, backdoor indicators and vulnerabilities without loading them Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It covers Pickle, PyTorch, Joblib, NumPy, TensorFlow, Keras, ONNX, SafeTensors, GGUF, XGBoost and LightGBM, plus ZIP, TAR and 7-Zip archives Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it fits CI with exit codes, strict mode and JSON or SARIF output Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release October 8, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . On ownership, Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI. OpenAI's developer documentation now says Promptfoo is part of OpenAI; we found no published closing date. Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) Best for teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI.

picklescan scans Python pickle files and reports flagged globals such as eval imports, with a summary of scanned and infected files Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . For registries, the --huggingface option scans a model repository on the Hugging Face Hub Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . For pipelines, exit codes are 0 for no malware, 1 for malware found and 2 for scan failure, with include and exclude filters for files and directories Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release July 1, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for teams that want a small free command-line scanner for pickle-based model files, including checks of Hugging Face repositories before download.

Fickling decompiles pickle data into Python AST and analyzes it statically, with symbolic execution instead of running the code Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its safety checks flag unsafe pickles through check_safety, is_likely_safe and the --check-safety command Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the LGPL-3.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release June 26, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for security researchers and ML engineers who want to read what a pickle file would do, or to block unexpected imports while loading pickles. Fickling is also the tool Hugging Face uses in its own documentation to show how a malicious pickle is built.

Step 3: scan at the registry

A manual scan depends on every developer remembering it. Put the check where models enter your organization instead: an internal model registry, an artifact store or the CI job that promotes a model. This part is our analysis:

• Scan on upload and again on promotion. A model that was clean when downloaded can be changed later, and a re-scan ties the result to the exact file you deploy.
• Block by default. Treat an unscanned model as untrusted, and let only scanned, signed artifacts reach production.
• Keep the report. Store the scanner output, version and file hash with the model record.

Public hubs scan too. Hugging Face documents that every file pushed to the Hub gets a ClamAV scan and a pickle import scan, with the list of imports shown next to each pickled file and suspicious imports highlighted. It also warns that this is best effort. Treat Hub scanning as a first filter and keep your own gate.

Hub scanning runs repository files under 2 GB through a ClamAV malware scan at each commit Source, checked October 21, 2026: huggingface.co · 2026-10-21 (opens in a new tab) . It shows results from third-party scanners from Protect AI (Guardian) and JFrog on the Hub Source, checked October 21, 2026: huggingface.co · 2026-10-21 (opens in a new tab) . This is a hosted Hub feature, not a scanner you run in your own pipeline. Pricing: included with platform Source, checked October 21, 2026: huggingface.co · 2026-10-21 (opens in a new tab) . On ownership, NVIDIA entered into a definitive agreement on September 2, 2026 to acquire Hugging Face. Its Form 8-K says closing is expected in the first half of 2027, subject to customary closing conditions including regulatory approvals. Source, checked October 21, 2026: sec.gov · 2026-10-21 (opens in a new tab) Best for teams that download models from the Hub and want to know what the Hub already checks before they add their own scanning.

Commercial scanners for registries and CI

Two commercial products in the category are built around registry and pipeline gates. Neither shows a separate price for model scanning on the pages we opened, so confirm formats and pricing with the vendor.

JFrog ML Model Security scans ML model files stored in Artifactory repositories, including models inside Docker images Source, checked October 21, 2026: docs.jfrog.com · 2026-10-21 (opens in a new tab) . It flags models that execute code during loading and verifies whether that code is malicious Source, checked October 21, 2026: docs.jfrog.com · 2026-10-21 (opens in a new tab) , and it proxies Hugging Face through remote repositories so third-party models pass through Artifactory Source, checked October 21, 2026: jfrog.com · 2026-10-21 (opens in a new tab) . One limit to check: JFrog’s documentation on ML models in Xray says malicious model detection and license detection cover Hugging Face models, while other model files get SBOM visibility and format identification only. Best for teams that already store artifacts in Artifactory and want Hugging Face models scanned before developers use them.

HiddenLayer Model Scanner analyzes models for malware, vulnerabilities, backdoors and unknown components before production Source, checked October 21, 2026: hiddenlayer.com · 2026-10-21 (opens in a new tab) . It runs model scans in GitHub Actions and can fail the pipeline when a model is flagged Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it scans models from a repository, a Hugging Face repo, Amazon S3 or Azure Blob Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . The scanner itself is closed source Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , although HiddenLayer publishes Apache-2.0 SDKs and CI integrations that call it. The vendor pages we opened list no supported model formats, so ask for the list before you buy. Best for security teams that want a vendor-supported scanner for third-party and in-house models, wired into GitHub Actions.

Model scanning also appears as one module inside broader AI security platforms, which we list in our AI-SPM category (see what is AI-SPM). Prisma AIRS scans GGUF, Pickle, PyTorch and Safetensors model files for hidden backdoors, malicious code and deserialization flaws Source, checked October 21, 2026: docs.paloaltonetworks.com · 2026-10-21 (opens in a new tab) . Noma Security scans models from open registries for malicious artifacts, hidden instructions and known vulnerabilities Source, checked October 21, 2026: noma.security · 2026-10-21 (opens in a new tab) . Check how much of the scanning you need is documented before you choose a platform over a dedicated scanner. That advice is our analysis.

Step 4: sign and verify

Scanning tells you what is inside a file. Model signing and hashing tell you whether it is the file you meant to get. OWASP recommends third-party model integrity checks using signatures and file hashes, and suggests keeping an up-to-date, signed inventory of components, noting that AI bills of materials are an emerging area (see AI-BOM). Hugging Face notes that signing commits with a GPG key does not prove a file is safe, only where it came from.

In practice, verify the signature or hash before you scan, pin models by hash in your configuration, and record the source. If the source cannot be verified, do not load the file on a machine you care about. For signatures, the open-source model-transparency project signs and verifies model files, as described below.

model-transparency signs a model by recording the hashes of its files in a signed record Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It also verifies a signature and recomputes file hashes to detect tampering Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release October 10, 2025 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . It signs and verifies models and does not scan them for malicious content, so use it next to a scanner and not instead of one. Best for teams that publish or consume models and want a free way to sign model files and check signatures before loading them.

Scanners, the safe format and signing compared

What scanning does not cover

• Hidden behavior in weights. A backdoored model can load safely and still behave badly. OWASP suggests red teaming third-party models for your use cases and using anomaly detection or robustness tests to catch tampering. Our guide to open-source AI red teaming tools lists tools for that.
• Poisoned training data. That is a separate risk, covered under data and model poisoning.
• Code that ships with a model. Review it like any other dependency.

Checklist

Our suggested minimum, in order:

1. Choose safetensors for new weights, and convert pickle-based weights where you can.
2. Download only from sources you can name, and verify the hash or signature.
3. Scan every pickle-based file before the first load, and fail closed.
4. Gate your registry or CI so that only scanned, recorded models are deployed.
5. Keep a record of the source, hash and scan result for each model.
6. Test third-party models for behavior, not just for malware.