Repolode
Submit
protectai

protectai/modelscan

A scanner that detects unsafe code hidden in ML model files before they are loaded, guarding against model serialization attacks.

View on GitHubWebsite
Stars
792
Forks
174
Open issues
105
Last commit
last month

What is it?

ModelScan checks machine learning model files for unsafe code embedded during serialization. Loading a malicious pickle-based model can run attacker code immediately, which can lead to credential theft, data theft, or poisoned model outputs. ModelScan avoids this risk by reading the file contents byte by byte and matching known unsafe code signatures, so the model is never executed.

The tool supports H5, Pickle, and SavedModel formats, covering models saved with PyTorch, TensorFlow, Keras, scikit-learn, XGBoost, and similar libraries that use pickle, dill, joblib, or cloudpickle. Detected issues are ranked from LOW to CRITICAL. Results can be printed to the console or exported as JSON, and a custom reporting format can be configured through a settings file.

It is installed with pip and can be run from the command line on a local model file, or called from Python code. Exit codes distinguish clean scans, issues found, and errors, which makes it straightforward to add to CI/CD pipelines.

Key features

  • 01Scans H5, Pickle, and SavedModel model files without loading them.
  • 02Covers models from PyTorch, TensorFlow, Keras, scikit-learn, and XGBoost.
  • 03Ranks detected unsafe code from LOW to CRITICAL severity.
  • 04Outputs reports to the console or as JSON, with custom formats via a settings file.
  • 05Provides a Python API and CLI with exit codes for scripting and CI use.

Use cases

  • Scanning third-party or Hugging Face models before loading them into a development environment.
  • Checking models produced by training pipelines for supply chain tampering before release.
  • Gating model deployment in CI/CD so that flagged models are blocked from reaching production.

Quick start

  1. 1

    Install ModelScan from PyPI

    pip install modelscan
  2. 2

    Scan a local model file

    modelscan -p /path/to/model_file.pkl

Things to know

  • Supports only certain model formats (H5, Pickle, SavedModel) and Pickle-derived formats.
  • TensorFlow and HDF5 scanning requires installing extras.

In collections

Security scanners, audits & threat intel tools

Topics

#machine-learning#security#model-security#pickle#pytorch#tensorflow#static-analysis#mlops

FAQ

What is modelscan?
A scanner that detects unsafe code hidden in ML model files before they are loaded, guarding against model serialization attacks. ModelScan checks machine learning model files for unsafe code embedded during serialization. Loading a malicious pickle-based model can run attacker code immediately, which can lead to credential theft, data theft, or poisoned model outputs. ModelScan avoids this risk by reading the file contents byte by byte and matching known unsafe code signatures, so the model is never executed.
Is modelscan free to use? What license does it have?
modelscan is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is modelscan still maintained?
Updated within 6 months. The last commit to modelscan was on Sep 28, 2026.
What can I use modelscan for?
Scanning third-party or Hugging Face models before loading them into a development environment. Checking models produced by training pipelines for supply chain tampering before release. Gating model deployment in CI/CD so that flagged models are blocked from reaching production.
How do I install modelscan?
Install ModelScan from PyPI: pip install modelscan Scan a local model file: modelscan -p /path/to/model_file.pkl
Where can I get modelscan?
The source code and installation instructions are on GitHub: https://github.com/protectai/modelscan

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects