Implementation guide
OWASP AISVS v1.01
Supply Chain Security for Models · Model Artifact Integrity
Scan models for malicious code
Verify that models are scanned for malicious code before import.
OWASP AISVS v1.01, requirement 6.1.1
In plain English
Scan every model you bring in from outside for malicious code before it enters your environment. Model files in some formats run code when they are loaded, and malicious models have been found on public model hubs more than once.
What good looks like
- Every imported model is scanned before it reaches internal storage or a developer's machine.
- A file that fails is quarantined, and someone is told.
- Scan results are recorded against the model's hash.
- Updates and new versions are scanned the same way as the first download.
How teams usually do it
- A model scanner in the import step, for example ModelScan, picklescan or Fickling, which inspect pickle and other formats for unsafe operations.
- Importing through an internal mirror or proxy, so scanning cannot be skipped.
- Preferring formats that cannot carry code (see 4.1.2). Scanners look for known bad patterns and can be evaded, so treat a clean scan as necessary and not sufficient.
Suggested evidence
- Import pipeline configuration.
- Scan reports for the models currently in use.
- A record of a quarantined file, or a test with a known-bad sample.
Common mistakes
- Scanning on first download and then pulling updates directly.
- Relying on the hub's own scan badge and running nothing yourself.
- Scanning the weights and ignoring Python files and configuration shipped in the same repository.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.