Views
No views yet
PyTorchUnsafeOpScan fails to scan malicious payloads in legacy-format .pt files.scan_pytorch() calls scan_pickle_bytes(multiple_pickles=False) on legacy .pt files. Legacy PyTorch serialization writes multiple sequential pickle streams (magic number, protocol version, sys_info, then object data). The scanner only examines the first pickle (the magic number integer) and stops -- all subsequent pickles containing malicious payloads are architecturally invisible.builtins.eval.modelscan.scanners.PyTorchUnsafeOpScanmultiple_pickles=False in scan_pytorch() at modelscan/tools/picklescanner.py:269pip install modelscan==0.8.8python poc-pytorch-modelscan-bypass.py.pt with importlib chain -- scanner reports 0 issues (false negative).pt with builtins.eval (blocklisted) -- scanner reports 0 issues (proves architectural bug)builtins.eval payload as .pkl -- scanner correctly detects itpickle.loads()