Model & ML supply-chain security
JFrog ML Security is a commercial scanner for ML models in Artifactory from JFrog. It is a commercial product offered as: SaaS, Self-hosted. Pricing model: paid.
Best for
Teams that already store artifacts in Artifactory and want Hugging Face models scanned before developers use them
Consider instead if
JFrog ML Model Security is the part of the JFrog platform that scans machine learning models. Xray analyzes ML model files stored in Artifactory repositories, including Docker images that contain models. The docs say it flags models that run code while loading, then a JFrog verification step checks whether that code is malicious, for H5, Paddle, PyTorch, Pickle, NumPy, Joblib, Dill, SavedModel and GGUF model types. Malicious-model detection and license detection apply to Hugging Face models, while other model files get format identification and SBOM visibility only. JFrog is a commercial product offered as SaaS or self-managed. Its pricing page marks model scanning as included in the Enterprise X and Enterprise + plans (and in self-managed Pro X), with no separate amount for it.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L3 Supply chain Model and supply chain | Primary | Check that models, datasets and AI components from outside are what they claim to be and do not run code or hide backdoors when loaded. | Follows its category, Model & ML supply-chain security |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM03 Supply Chain | Scans and gates third-party models, including license checks, as they enter Artifactory. | Scans ML model files stored in Artifactory repositories, including models inside Docker images; Flags models that execute code during loading and verifies whether that code is malicious; Detects licenses on Hugging Face models; Proxies Hugging Face through remote repositories so third-party models pass through Artifactory; Lets models identified by Xray be managed in the JFrog AI Catalog, a central registry for finding, curating and approving ML assets by policy |
More in Model & ML supply-chain security, ranked within the category by Coverage Score.
OpenAI (Promptfoo)
Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.
Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Reviewed
Palo Alto Networks (Protect AI)
Scans saved ML model files for unsafe serialized code before you load them, from a CLI or Python.
Best for: ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Reviewed
Signs machine learning model files and verifies them later so tampering can be detected.
Best for: Teams that publish or consume models and want a free way to sign model files and check signatures before loading them
Reviewed
The docs say malicious-model detection applies to Hugging Face models. Other model files get format identification and SBOM visibility only.
The docs list H5, Paddle, PyTorch, Pickle, NumPy, Joblib, Dill, SavedModel and GGUF as the model types the scanners check for malicious code, identified by binary header values and file extensions. The docs name Hugging Face as the supported repository.
The pricing page marks ML model scanning as included in the SaaS Enterprise X and Enterprise + plans, and in the self-managed Pro X, Enterprise X and Enterprise + plans. It shows no separate amount for it.
No. It is part of the commercial JFrog platform, offered as SaaS or self-managed, and we found no public source repository for it.
JFrog ML Security is closed source (proprietary).
Source Source, checked October 21, 2026: jfrog.com (opens in a new tab) Checked
JFrog ML Security is offered as: SaaS, Self-hosted.
Source Source, checked October 21, 2026: jfrog.com (opens in a new tab) Checked
Pricing model for JFrog ML Security: Paid: On the pricing page, ML model scanning is marked as included in the SaaS Enterprise X and Enterprise + plans.
Source Source, checked October 21, 2026: jfrog.com (opens in a new tab) Checked
Status of JFrog ML Security: Active.
Source Source, checked October 21, 2026: docs.jfrog.com (opens in a new tab) Checked
We have no commercial relationship with JFrog.