Skip to main content
The model file contains unsafe or suspicious serialized code that may execute when the model is loaded.

​
How to resolve

Serialization issues represent a critical supply-chain risk. Because malicious code can be embedded directly within model files, an environment may be compromised immediately upon model initialization. As a result, some of the following suggested safeguards may be relevant to mitigate this risk and protect the runtime environment.
  • Switch to safe formats: Transition away from formats like Pickle, PyTorch (.pt/.pth), or Keras (H5), which allow arbitrary code to run during loading. Use Safetensors or other weights-only formats that do not support executable code.
  • Verify model provenance: Only load models from trusted, verified sources. Check the cryptographic hash of the model file against the developer’s original documentation to ensure the file has not been tampered with during transit (model-in-the-middle attack).
  • Isolate the loading process: Always load unverified or third-party models in a restricted sandbox or a network-isolated container. This prevents an embedded Trojan horse from accessing your cloud credentials, environment variables, or internal network.

​
Risk

Governance/Compliance Serialization issues violate key requirements across multiple frameworks:
  • NIST AI RMF (GOV-6, MAP-2, MEAS-2): Requires supply-chain integrity, protection against unauthorized modifications, and continuous adversarial testing.
  • EU AI Act (Art. 9 - 15): Requires tamper-resistant technical documentation and safeguards against model modification.
Compromised serialized models break these expectations by undermining provenance, integrity, and auditability. Security A successful model serialization attack can result in immediate remote code execution the moment a model is loaded. Potential consequences include:
  • Credential theft: cloud access keys, tokens, and secrets.
  • Data theft: extraction of user inputs or inference data.
  • Data poisoning: corrupting downstream datasets or pipelines.
  • Model poisoning: silently altering model behavior or outputs.

​
Explanation

Machine learning models are stored using serialization formats (like Pickle, H5, SavedModel) that can embed executable code. If malicious code is inserted during saving, it runs automatically when the model is loaded—similar to a Trojan horse.

​
Specifications

Trigger: vulnerabilities with UNSAFE SERIALIZATION category found Severity: CRITICAL, HIGH, MEDIUM or LOW (depending on the serialization problem detected) Applies to: Models