4 ms·
For a long time I thought models were just weights. The first time I heard that Hugging Face models contain executable code was at FOSDEM in Stephen Chin's ta
by weinzierl 3y ago
For a long time I thought models were just weights. The first
time I heard that Hugging Face models contain executable code was at FOSDEM in Stephen Chin's talk: "Security Starts Within the SBOM".
I think there was also an example where Python code with a try block, when it failed because of a missing dependency did a `sudo apt install` in the catch block.
Not sure how much SBOMs help, but we sure need to get this supply chain mess in order.
- morkalork 3y agoI kind of wish I hadn't just read this. Thanks.
- fzzzy 3y agoThis is only true for models that are python pickles. gguf doesn't suffer from this. The ml community needs to move away from pickle files as soon as possible. Worst idea ever.
- water-data-dude 3y agoWHAT? Python warns you in the most apocalyptic language possible that pickles are dangerous as hell. Are the pickle files buried in the HF models in a non-obvious way? I can’t imagine people would just run random pickles from the internet (but then again, people do run `curl [URL] | bash` all the time…)
- fzzzy 3y agoI'm not responsible for whatever led the ml community to the widespread use of pickles for weights. It happened regardless of the warnings that pickles are dangerous. Yes, ml researchers have been running random pickles from the internet for years now. No they are not buried in a non obvious way. They are at the very top of many models. safetensors and gguf have started to replace this horrible practice, but there are still tons of models that use pickles.