Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Workload Sandboxing & Validation
Load only safe model file formats
Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.
OWASP AISVS v1.01, requirement 4.1.2
In plain English
Some model file formats can run code when they are opened. Python pickle, which older PyTorch checkpoints use, is the best-known example. Load only formats that hold data and nothing else, and have the loader refuse the rest.
What good looks like
- A written allow-list names the formats you accept, for example safetensors, GGUF and ONNX.
- Loaders reject files in any other format, whatever their extension says.
- Third-party models in unsafe formats are converted in an isolated environment before use, or refused.
- A test confirms a pickle-based file is rejected.
How teams usually do it
- Use safetensors for weights. In PyTorch, keep weights_only=True on torch.load (the default since version 2.6) and never turn it off for files you did not create.
- Add a pipeline check that inspects file contents and fails on pickle, joblib, or Keras files with embedded Lambda layers.
- Also run a model scanner such as ModelScan, picklescan or Fickling at import (see 6.1.1). Scanners catch known tricks. The format allow-list removes the capability.
Suggested evidence
- The allow-list and the loader configuration that enforces it.
- A test showing a pickle file is rejected.
- Pipeline logs of the format check on a recent import.
Common mistakes
- Loading a downloaded model with a setting that still permits pickle, often because a tutorial said to.
- Checking the file extension and not the content.
- Forgetting the files around the weights. Custom code in a repository (for example anything that needs trust_remote_code=True) runs with full privileges.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.