ml-security

• SKILL.mdcore · 6,376 bytes
• SKILL.mdcore · 6,376 bytes
• SKILL.mdcore · 6,376 bytes
• SKILL.mdcore · 6,376 bytes
• SKILL.mdcore · 6,376 bytes
• metadata.jsonasset · 1,417 bytes
• references/artifacts-and-provenance.mddoc · 6,384 bytes
• references/verifying-findings.mddoc · 3,592 bytes

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/ml-security/SKILL.md. -->

# ML Model Security

The model and data artifacts: checkpoint formats that execute code on load, provenance for a model you did not train, training-data poisoning and the ingestion controls that bound it, PII that survives into weights, and notebooks that commit their own output. Use when loading a model from disk, a Hub, or object storage, ingesting user content for training or fine-tuning, or writing training, evaluation, or notebook code.

## ALWAYS

- Prefer a **tensor-only format** — safetensors — for anything you load. It stores arrays and metadata and has no mechanism for executing code, which is the property that matters. A `.pt`, `.pkl`, `.bin`, `.ckpt` or `joblib` artifact is a pickle: loading it runs whatever the author put in it, before you see a single weight.
- Pass `weights_only=True` to `torch.load` **explicitly**, every time. The default has changed across PyTorch releases, so code that relies on it behaves differently depending on the pin — and the flag narrows the surface without removing it, so it is a mitigation rather than a reason to load an untrusted file. `deserialization-security` owns the pickle boundary itself and the per-language detail; `references/artifacts-and-provenance.md` has the format-by-format table.
- Establish provenance before loading: the artifact's **hash matches one you recorded** from a source you decided to trust, at a revision you pinned. A hash the artifact came with proves only that the file is the file. `supply-chain-security` owns what makes a source trustworthy, and its rule holds here — a checksum served next to the download is not authentication, and an author's name is not a signature.
- Pin the Hub revision to an **immutable commit**, not a branch or tag. `main` moves, and `from_pretrained(..., revision="<sha>")` is the difference between a model you reviewed and whatever is there today. Where the loader offers `trust_remote_code`, understand that enabling it executes repository Python at load time, which is the same exposure as the pickle it was meant to avoid.
- Bound what user-contributed data can do to a model. Attribute each training record to its source, keep contributed data in a separate pool from curated data, gate promotion between them on review, and cap how much any single contributor can influence one training run. Poisoning does not need many records — it needs enough of them near one behaviour.