Model & ML supply-chain security
ModelScan is an open-source model file scanner from Palo Alto Networks (Protect AI). It is released under the Apache-2.0 license and is offered as: CLI, Library.
Best for
ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Ownership
Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)
Consider instead if
ModelScan is an open-source Python tool from Protect AI that checks saved machine learning model files for unsafe code. It reads a file's bytes for unsafe code signatures without loading the model, and ranks findings as critical, high, medium or low. It supports H5, Pickle and SavedModel formats, plus Keras V3 and pickle-derived formats from joblib, dill and cloudpickle. You run it from a command line or from Python, and the README suggests scanning before training, after training and before deployment, including in CI/CD pipelines. The code is Apache-2.0. The README also points to Guardian, an enterprise model scanning product from the same vendor.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L3 Supply chain Model and supply chain | Primary | Check that models, datasets and AI components from outside are what they claim to be and do not run code or hide backdoors when loaded. | Follows its category, Model & ML supply-chain security |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM03 Supply Chain | Scans downloaded and internally built model files for unsafe serialized code. | Scans saved model files for unsafe code signatures without loading the model; Supports H5, Pickle and SavedModel formats, plus Keras V3 and joblib, dill and cloudpickle files; Checks Pickle files and pickle-derived formats for unsafe code |
| LLM04 Data and Model Poisoning | The README lists model poisoning and data poisoning among the outcomes of model serialization attacks it scans for. | Reports findings ranked critical, high, medium or low and targets model serialization attacks such as credential theft and model poisoning |
More in Model & ML supply-chain security, ranked within the category by Coverage Score.
OpenAI (Promptfoo)
Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.
Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Reviewed
Signs machine learning model files and verifies them later so tampering can be detected.
Best for: Teams that publish or consume models and want a free way to sign model files and check signatures before loading them
Reviewed
Matthieu Maitre
Scans pickle files, PyTorch archives and Hugging Face repos from the command line for suspicious globals.
Best for: Teams that want a small free command-line scanner for pickle-based model files, including checks of Hugging Face repositories before download
Reviewed
Yes. ModelScan is released under the Apache-2.0 license, and the code is on GitHub at protectai/modelscan.
The README lists H5, Pickle and SavedModel formats, plus Keras V3 and pickle-derived formats from joblib, dill and cloudpickle.
Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. The ModelScan README does not mention the acquisition.
ModelScan is released under the Apache-2.0 license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
ModelScan is offered as: CLI, Library.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Pricing model for ModelScan: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Latest release of ModelScan: February 18, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with Palo Alto Networks (Protect AI).