ML Model Loader Running Unexpected Code? Fix It Now

Updated 4 November 2026 · Standard formula, shown below

If a machine learning model loader runs unexpected code, immediately isolate the environment, stop the process, and inspect the loader’s source and the model file for embedded malicious payloads. This guide explains how to detect, contain, and prevent such code execution when loading models from untrusted sources.

Background: Why Model Loaders Can Execute Code

Machine learning models are not just data files; they often contain serialized objects, custom operators, or configuration files that can trigger code execution during loading. Popular frameworks like PyTorch, TensorFlow, and ONNX rely on deserialization mechanisms (e.g., Python’s pickle, TensorFlow’s SavedModel format) that can invoke arbitrary functions when loading. This is a known security concern: a malicious model can run code on your machine simply by being loaded. The risk increases when you download models from unverified sources or use loaders that automatically trust metadata.

Immediate Steps to Take

Stop the process: If you suspect unexpected code ran, kill the Python process or container immediately (e.g., Ctrl+C or kill <PID>). This limits potential damage.
Disconnect from the network: Unplug Ethernet or disable Wi-Fi to prevent data exfiltration or further downloads.
Isolate the environment: Move the machine off the network, or at least run subsequent analysis in a sandboxed virtual machine or container with no access to sensitive files.
Inspect the loader code: Review the exact loader function you called. Look for pickle.load, torch.load, tf.saved_model.load, or similar functions that may deserialize untrusted data. Check if the loader has any hooks or custom import mechanisms.
Examine the model file: Use a hex editor or a tool like strings to look for suspicious strings (e.g., os.system, subprocess, eval, exec). For pickle-based files, you can use pickletools to disassemble the bytecode and spot unexpected REDUCE or GLOBAL opcodes.

How to Safely Load Models from Untrusted Sources

If you must load a model from an untrusted source, never do it on a production machine or a machine with sensitive data. Instead:

Use a dedicated, disposable virtual machine or a Docker container with no network access and no mounted sensitive directories.
Run the loader as a non-privileged user with minimal permissions.
Use a sandboxing tool like firejail or nsjail to restrict system calls and file access.
Consider using a safe loading method: for PyTorch, use weights_only=True in torch.load (available in recent versions) to avoid executing arbitrary pickled objects. For TensorFlow, use tf.saved_model.load with experimental_skip_checkpoint or load only the weights via h5 files if possible.
Convert the model to a safer format like ONNX, which is a static graph format, but be aware that ONNX can still have custom operators that may execute code.

Common Problems and Misconceptions

A common misconception is that only pickle files are dangerous. In reality, any format that supports custom code, such as TensorFlow’s SavedModel (which can contain Python code in the assets or variables directories) or even JSON with a __class__ field in some libraries, can be exploited. Another issue is that many loaders do not validate the integrity of the model file; a man-in-the-middle attack could replace a legitimate model with a malicious one. Always verify checksums or signatures if provided.

Comparison of Model Formats and Their Risks

Pickle (PyTorch, sklearn): Extremely dangerous; arbitrary code execution is trivial. Use weights_only=True or avoid loading untrusted pickles.
HDF5 (Keras): Generally safer but can still contain custom objects that trigger code. Use safe_mode=True if available.
ONNX: Static graph, but custom operators can reference external code. Only load from trusted sources.
TensorFlow SavedModel: Can include Python code in assets; treat as untrusted.
JSON/Config files: May contain paths or class names that loaders use to instantiate objects, leading to code execution if not sanitized.

Prevention and Best Practices

Only download models from official repositories or trusted hubs (e.g., Hugging Face, official model zoos) and verify integrity with SHA256 checksums.
Use a dedicated service or API to load models, so that the loading process is isolated from your main application.
Keep your ML frameworks updated; security patches often address deserialization vulnerabilities.
Monitor system logs and network connections during model loading to detect anomalies.
Implement a security policy that treats any model as untrusted until proven otherwise.

Frequently Asked Questions

Can a model execute code just by being loaded?

Yes, if the model format supports serialized objects that can invoke functions during deserialization. For example, a pickle file can contain a reduce instruction that calls os.system when loaded.

How do I know if a model file is malicious?

Inspect the file’s contents: use strings to look for suspicious commands, use pickletools to disassemble pickle files, and check for any unusual file sizes or hidden files. However, static analysis may not catch all obfuscated payloads; dynamic analysis in a sandbox is more reliable.

Is it safe to load models from Hugging Face?

Hugging Face has security scanning, but it is not foolproof. Treat any model as untrusted and use the same precautions as with any external file. Prefer models from reputable organizations with many downloads and positive reviews.

What should I do if I already loaded a malicious model?

Immediately disconnect from the network, run a full antivirus scan, and consider the machine compromised. Change any credentials that may have been accessed, and restore from a clean backup if necessary. In a corporate environment, report to your security team.

Can I disable code execution in model loaders?

Some loaders offer safe modes, such as weights_only=True in PyTorch, which restricts unpickling to tensors and basic types. For other formats, you may need to implement custom loaders that only extract weights and ignore metadata.

Are there tools to scan model files for malware?

There are specialized tools like picklescan that can detect suspicious pickle opcodes. General antivirus may also flag known malicious patterns, but they are not comprehensive. Always combine static analysis with sandboxed execution.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.