Scan a checkpoint for a hidden pickle exploit

Downloaded a checkpoint from a repo I'd never heard of. Loaded it straight away.

IntermediateRead 6 minDoing: an hour6 steps

What you'll have at the end

A written verdict on the checkpoint: cleared as safe to load, or rejected with the exact import and instruction that made it dangerous.

Before you start

You need

You have a downloaded model checkpoint file sitting on disk that you have not loaded into anything yet, and a Python setup where you can run a scanner and read raw file bytes.

Not covered

Auditing a different serialization format's own code-execution history (each one has its own separate list of past exploits and its own separate tooling) is a different job; this covers the case where the checkpoint turns out to be a pickle file specifically.

Leans on

Hugging Face Ecosystem Cheat SheetHas the safetensors format and pickle scanning rows this recipe pulls its first two moves from.
PyTorch Cheat SheetHas the row on loading a checkpoint through a restricted loader, the second gate this recipe ends on.
LLM Security & Safety Cheat SheetPlaces a single bad checkpoint inside the wider supply-chain risk a downloaded model carries.

6 steps

Checked 15 Aug 2026

Part of the LLM Security & Safety cookbook