arseniibr

4 ms·

1.
by arseniibr 8mo ago
Hi guys, How do devs typically secure/monitor the hygiene of their notebooks? I scanned about 5000 random notebooks on GitHub and ended up finding almost 30 aws/oai/hf/google keys (frankly, they were inactive, but still)
2.
Recomendation for open-source tool for the AI supply chain security(github.com)
1 points by arseniibr 8mo ago|1 comments
3.
by arseniibr 8mo ago
Hi HN, I’m working on an open-source tool Veritensor: https://github.com/arsbr/Veritensor The goal is to help teams secure the AI/ML supply chain as models, datasets, and tooling increasingly come from third parti
4.
by arseniibr 9mo ago
I agree that fixing the pipeline is indeed the correct decision, but I've created this tool to provide the detection. In a complex environment, you often don't control the upstream ingestion methods used by every team. They might
5.
by arseniibr 9mo ago
Don't you suppose that in a large company with teams of 50+ devs/DS pulling models for experiments, enforcing a manual "review+polish+convert" workflow for every single artifact can create a massive bottleneck and, as a
6.
by arseniibr 9mo ago
PyTorch relies on Python's pickle module for serialization, which is essentially a stack-based virtual machine. This allows for saving arbitrary Python objects, custom classes, etc., but the trade-off is security. The PyTorch docs expl
7.
by arseniibr 9mo ago
In an ideal local environment with a properly configured git client, sure. But in real-world CI/CD pipelines, people can use wget, curl, or custom caching layers that often pull the raw pointer file instead of the LFS blob. When that h
8.
by arseniibr 9mo ago
Safetensors solves RCE, but it doesn't solve legal liability. I scan .safetensors because metadata headers often contain restrictive licenses (like CC-BY-NC) that contradict the repo's README. Deploying a non-commercial model in a
9.
by arseniibr 9mo ago
Safetensors is the goal, but legacy models are still there. A massive portion of the ecosystem (especially older fine-tunes and specialized architectures) is still stuck on Pickle/PyTorch .bin. Until 100% of models migrate, we need too
10.
by arseniibr 9mo ago
Thank you for the valuable feedback. I agree that having granular CLI flags is better for ad-hoc scans or CI pipelines where you don't want to commit a config file. Splitting it into --ignore-license vs --ignore-malware (which should p
11.
I scanned 2,500 Hugging Face models for malware/issues. Here is the data(github.com)
24 points by arseniibr 9mo ago|19 comments
12.
Stop trusting torch.load() – I built a tool to scan AI models for RCE(github.com)
1 points by arseniibr 9mo ago|0 comments
13.
by arseniibr 9mo ago
OP here. One of the annoying edge cases I hit was handling "Zip Bombs" in PyTorch files (since .pt is just a zip). Had to implement a stream reader with strict memory limits to prevent the scanner itself from OOMing on malicious a
14.
Veritensor – open-source tool to scan AI models for malware and license issues(github.com)
1 points by arseniibr 9mo ago|2 comments
15.
by arseniibr 9mo ago
Hi guys, I've been working with MLOps pipelines lately, and it always bothered me that torch.load() (and Pickle in general) is basically an RCE vulnerability we've all just accepted. We download gigabytes of opaque weights from Hu