Model & ML supply-chain security
ModelAudit is an open-source static scanner for ML model files from OpenAI (Promptfoo). It is released under the MIT license and is offered as: CLI, Library, Self-hosted.
Best for
Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Ownership
Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI. OpenAI's developer documentation now says Promptfoo is part of OpenAI; we found no published closing date. Source, checked October 21, 2026: promptfoo.dev (opens in a new tab)
Consider instead if
ModelAudit is an open-source scanner from Promptfoo for AI and ML model files. The README says it inspects files for malicious code, backdoor indicators and vulnerabilities without loading or executing them. It lists 45 registered scanners covering model, archive and config formats such as Pickle, PyTorch, Joblib, TensorFlow, Keras, ONNX, SafeTensors and GGUF. It runs from a command line or a Docker image, can read models from Hugging Face, S3, Google Cloud Storage, MLflow and JFrog Artifactory, and writes text, JSON or SARIF. It can emit a CycloneDX SBOM and exits with codes for CI. The code is MIT-licensed.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L3 Supply chain Model and supply chain | Primary | Check that models, datasets and AI components from outside are what they claim to be and do not run code or hide backdoors when loaded. | Follows its category, Model & ML supply-chain security |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM03 Supply Chain | Scans downloaded and internal model files, writes an SBOM and checks licenses. | Statically inspects model files for malicious code, backdoor indicators and vulnerabilities without loading them; Covers Pickle, PyTorch, Joblib, NumPy, TensorFlow, Keras, ONNX, SafeTensors, GGUF, XGBoost and LightGBM, plus ZIP, TAR and 7-Zip archives; Generates a CycloneDX SBOM and checks licenses in strict mode; Validates licenses in strict mode and lists license violations as supply chain risks; Reads models from Hugging Face, S3, Google Cloud Storage, MLflow, JFrog Artifactory and DVC |
| LLM04 Data and Model Poisoning | The README says it looks for backdoor indicators in model files. | Flags embedded secrets, network indicators, archive exploits and unsafe ML operations |
More in Model & ML supply-chain security, ranked within the category by Coverage Score.
Palo Alto Networks (Protect AI)
Scans saved ML model files for unsafe serialized code before you load them, from a CLI or Python.
Best for: ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Reviewed
Signs machine learning model files and verifies them later so tampering can be detected.
Best for: Teams that publish or consume models and want a free way to sign model files and check signatures before loading them
Reviewed
Matthieu Maitre
Scans pickle files, PyTorch archives and Hugging Face repos from the command line for suspicious globals.
Best for: Teams that want a small free command-line scanner for pickle-based model files, including checks of Hugging Face repositories before download
Reviewed
Yes. It is released under the MIT license, and the code is on GitHub at promptfoo/modelaudit.
No. The README says it inspects model files for malicious code and vulnerabilities without loading or executing them.
It is published by Promptfoo, which OpenAI's developer docs say is part of OpenAI. Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI; the ModelAudit README does not mention the deal.
ModelAudit is released under the MIT license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
ModelAudit is offered as: CLI, Library, Self-hosted.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Pricing model for ModelAudit: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Latest release of ModelAudit: October 8, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with OpenAI (Promptfoo).