Research seriesL3offensive security
A model file is executable-adjacent code and a trust boundary most teams skip. From pickle deserialization to adapter tampering, the artifact itself is an attack surface. This threat lab maps the artifact threat model, deserialization and loader code execution, weight and adapter tampering, distribution and typosquatting on model hubs, and signing plus provenance for verification at load — each paired with a hardening. Grounded in the primary supply-chain security standards and literature.
A model file is not passive data — for many formats it is executable-adjacent code, and loading it can run whatever the artifact author chose.
The danger is not the weights — it is the wrapper: a serialization format that reconstructs objects by running code turns loading a model into running the author's program.
Adapters make models modular and shareable — and turn a small, innocuous-looking file into a way to change what a model does after you thought it was fixed.
The safest checkpoint in the world does you no good if you download the wrong one — name confusion turns a trusted model reference into an attacker's artifact.
The whole model supply chain reduces to one control done well: sign artifacts, attest how they were built, and verify both at the moment you load.