Skip to main content

How to scan ML models

Machine learning (ML) models are distributed differently from many other software package types. Instead of being packaged as collections of source files or binaries, they are usually stored as serialized files that contain the information needed to recreate and use the model.

Because of this, the serialization format plays an important role in how ML models are scanned. Some formats can contain executable logic that runs when the model is loaded, while others are designed to store model data only. For example, Pickle-based formats (.pkl, PyTorch .pt, .pth, and many .bin files) can execute code during deserialization. Other formats, including Safetensors, ONNX, and GGUF, are designed to store model data without supporting arbitrary code execution during loading.

Spectra Assure identifies the serialization format before performing analysis because different formats support different capabilities and therefore require different types of processing. Supported ML model formats are listed on the Community and language coverage page.

Why serialization matters​

Serialization is the process of saving a trained machine learning model to a file so it can be stored, shared, and deployed. Deserialization loads that file back into memory so the model can be used.

The security risk arises because some serialization formats can embed executable code that runs automatically during deserialization. As a result, loading an untrusted model can run malicious code before it's ever used as intended.

To avoid this, Spectra Assure analyzes supported model formats statically, without loading them into a machine learning framework. This allows potentially unsafe behavior to be identified before a model is ever loaded.

What Spectra Assure examines​

For most package types, Spectra Assure begins by exposing the files and components contained within a package. ML models are different: rather than unpacking a hierarchy of files, Spectra Assure analyzes the serialized model file itself.

Depending on how the model is distributed, Spectra Assure may examine:

  • serialized model files
  • model metadata
  • the serialization format and file structure
  • supporting files included with the model
  • packages containing one or more model files

Spectra Assure focuses on security analysis rather than evaluating the model itself. It identifies malware, tampering, embedded secrets, and behaviors that may indicate a security issue when the model is loaded or distributed.

How ML models are processed​

ML models follow the same overall scanning workflow as other supported package types, only the processing step differs. For ML models, Spectra Assure:

  1. Identifies the serialization format, so the correct analysis method can be applied.
  2. Processes the model contents, parsing the serialized file to expose the information needed for analysis without loading it into a machine learning framework.
  3. Analyzes security indicators and behaviors, looking for malware, tampering, embedded secrets, and behaviors associated with malicious or unsafe activity, including unsafe deserialization.
  4. Classifies the findings by severity and risk, helping teams decide which issues need immediate attention.

When and why to scan ML models​

ML models should be scanned before they're introduced into an environment, whether they come from an internal repository or a third-party source. Common points for scanning include:

  • when introducing third-party models into an environment
  • before distributing internally developed models
  • as part of CI/CD pipelines
  • before releasing software packages containing ML models

Even though many ML models are distributed as a single file, they should be treated as software artifacts. Depending on the format, loading one may execute code during deserialization.

Scanning before a model is loaded helps organizations:

  • Detect risks earlier. Unsafe deserialization behavior can be identified before the model is used.
  • Reduce supply chain risk. Third-party models can be validated alongside other software dependencies.
  • Simplify remediation. Addressing issues before deployment is less disruptive than responding after a compromised model is already in use.
  • Automate security checks. Model scanning integrates into CI/CD pipelines alongside other package scans.
  • Improve visibility. Every scan adds to an inventory of the ML models present across a package.

Where to find identified models​

When Spectra Assure identifies ML models during package analysis, they are added to the ML-BOM, which is part of the xBOM.

The ML-BOM inventories the models found in the analyzed software package together with any available metadata. It complements the package security findings by making it easier to identify and track the machine learning assets included in the package.

In the SAFE report, ML models are available under Bill of Materials > ML Models.