Safe model loading and artefact scanning

What it does

It prevents a model file from acting as malware. Model files are handled as executable software from an unknown publisher until shown otherwise. External artefacts are quarantined, checked and brought into an internal registry, and working environments load from that registry only. Security owns the standard and the platform team enforces it, before any external artefact is first opened.

How to implement it

• Maintain an internal registry; block direct download from public hubs to working machines.
• Prefer file formats that hold weights only and cannot carry code.
• Disable loading options that fetch or run remote code.
• Scan artefacts for embedded code and known malicious patterns.
• Verify the publisher and the published hash.
• Open unfamiliar artefacts first in an isolated environment.

Evidence it operates

Design: a standard listing approved sources, formats and settings. Operation: registry records showing scan results for each external artefact; network controls blocking direct hub access; a test in which a file in a prohibited format is refused.

Where it fits

Operates at the point an external artefact enters the organisation. It is a primary control for malicious model artefacts and unsafe loading and works with model artifact signing, which protects artefacts once approved.

Limits

Scanning finds code in a file, not behaviour in the weights: a backdoored model in a safe format passes. Custom model architectures sometimes need code to load, which reopens the exposure and requires review of that code. The internal registry also becomes a single point of trust, so write access to it must be tightly held.