Model & ML supply-chain security
Fickling is a pickle decompiler and static analyzer from Trail of Bits. It is open source under the LGPL-3.0 license and is offered as: CLI, Library.
Best for
Security researchers and ML engineers who want to read what a pickle file would do, or to block unexpected imports while loading pickles
Consider instead if
Fickling is an open-source Python library and command-line tool from Trail of Bits for working with pickle files. It decompiles pickle data into readable Python, and its safety checks use symbolic execution of the pickle machine rather than running the code. It can scan pickles inside model files, including PyTorch files, and a runtime hook checks each import against an allowlist of safe imports while a pickle loads. The README also lists commands to trace execution and to inject code into pickles. It installs with pip, and PyTorch support needs the torch extra. Fickling is released under the LGPL-3.0 license and costs nothing to use.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L3 Supply chain Model and supply chain | Primary | Check that models, datasets and AI components from outside are what they claim to be and do not run code or hide backdoors when loaded. | Follows its category, Model & ML supply-chain security |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM03 Supply Chain | Analyzes pickle files inside model artifacts and can block unexpected imports while loading them. | Decompiles pickle data into Python AST and analyzes it statically, with symbolic execution instead of running the code; Safety checks flag unsafe pickles through check_safety, is_likely_safe and the --check-safety command; Scans pickles inside AI and ML model files, including PyTorch files; Runtime hook checks each import against an allowlist of safe imports and raises an exception on anything else |
More in Model & ML supply-chain security, ranked within the category by Coverage Score.
OpenAI (Promptfoo)
Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.
Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Reviewed
Palo Alto Networks (Protect AI)
Scans saved ML model files for unsafe serialized code before you load them, from a CLI or Python.
Best for: ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Reviewed
Signs machine learning model files and verifies them later so tampering can be detected.
Best for: Teams that publish or consume models and want a free way to sign model files and check signatures before loading them
Reviewed
Yes. Fickling is released under the LGPL-3.0 license, and the code is on GitHub at trailofbits/fickling.
The README says its Pickle Machine symbolically executes the code rather than overtly executing it, which is why analyzing untrusted files is considered safe.
With pip install fickling. The README says PyTorch support requires the fickling[torch] extra.
Fickling is released under the LGPL-3.0 license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Fickling is offered as: CLI, Library.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Pricing model for Fickling: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Latest release of Fickling: June 26, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with Trail of Bits.