AI Security Atlas › All entries › Model Supply Chain & Training Integrity
Safe Artifact Loading Policy
Loaders accept only tensor-only formats and run first-time conversions inside an isolated sandbox.
Open in the interactive atlas →Impact
Removes deserialization RCE as a class from model pipelines.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Unsafe Model Deserialization (Critical).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Unsafe Model Deserialization Vulnerability · Critical severity
Builds on
- Signed Model Registry & AIBOM Guardrail · Fixes critical risks
Remediation
- Allowlist file extensions at the registry boundary.
- Run ModelScan-style scanners on every upload.
- Quarantine artifacts that contain opcodes beyond tensor data.
How to verify
- Known-malicious pickle fixtures are rejected at upload.
- Serving images contain no pickle-capable loader paths.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM03:2025 Supply Chain
MITRE ATLAS
NIST AI RMF 1.0
- MANAGE 3.2 Pre-trained models are monitored as part of regular maintenance