You can deploy this model and start earning money today!

pragnyanramtha/
pytorch-package-local-reducer-modelscan-bypass

Name: pytorch-package-local-reducer-modelscan-bypass
Availability: InStock

Views

No views yet

PyTorch Package package-local reducer ModelScan bypass PoC

Summary

This is a benign proof of concept for a PyTorch Package archive whose pickle resource resolves a reducer target from package-local Python source.

ModelScan 0.8.8 scans the embedded pickle and reports zero issues, but skips the package-local .py file that supplies the reducer callable. Loading the resource with PackageImporter.load_pickle("localcall", "payload.pkl") executes the package-local callable and writes a benign marker file.

This is a scanner/runtime mismatch report. It is not a claim that PyTorch Package code execution is unexpected; PyTorch documents packages and pickle content as trusted-code inputs.

Files

package_local_callable.pt: PoC PyTorch Package artifact.
make_poc.py: Builds the artifact from benign package-local source.
verify.py: Runs runtime and scanner checks.
verify_result.json: Captured verifier output after local validation.

Reproduce

bash

python -m venv .venv
. .venv/bin/activate
pip install torch==2.11.0 modelscan==0.8.8
python make_poc.py
python verify.py

Expected runtime result:

runtime_value: package-local-callable
marker_text: PACKAGE_LOCAL_CALLABLE

Expected scanner result:

ModelScan scans package_local_callable.pt:package_local_callable/localcall/payload.pkl
total_issues: 0
The package-local localcall/marker.py is skipped as unsupported

Artifact

File: package_local_callable.pt
SHA256 after local staging generation: ad0754085aec04ede2cf5ad0f7960f0a340a12233dabe8a2c0f45c4d323440b1
Tested runtime: torch 2.11.0+cpu
Tested scanner: modelscan 0.8.8

Impact

A workflow that accepts a clean ModelScan result for PyTorch Package files can miss package-local code that is reached during PackageImporter.load_pickle.

Limitations

Severity is Medium.
Requires a caller to use PackageImporter.load_pickle.
This is a ModelScan coverage gap, not a PyTorch core vulnerability.
The PoC writes only a local benign marker file.

pragnyanramtha/pytorch-package-local-reducer-modelscan-bypass