Read as
Last updated: April 29, 2026
AI models are software you don’t see. Supply chain matters.
AI models are software you don’t see. Supply chain matters.
Pickle deserialisation
PyTorch models default to Python pickle format. Pickle = arbitrary code execution. Loading a malicious pickle = RCE.
Defence: use SafeTensors format. Hugging Face migrated; PyTorch 2.6+ defaults to safer mode.
Hugging Face hub trust
Anyone can publish models. Imitating popular models with malicious modifications has been demonstrated.
Defences
- Pin model versions (revision hash)
- Use SafeTensors
- Review model cards for licence + creator reputation
- Scan downloaded models with picklescan
- Internal model registry for production
🧠
Check your understanding
Module Quiz · 5 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants