Study model serialization risks

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R12 — Safetensors format & security

   R11 — Hugging Face remote code & revision pinning

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study model serialization hazards (pickle arbitrary code execution vs. safetensors format) and trust_remote_code risks.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   In an isolated disposable container, compare a safe tensor load against a benign demonstration of pickle deserialization behavior; enforce safe-loading policy in code.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Safe-loading architecture decision record (ADR) and scanner policy rejecting unsafe weight formats.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R11Hugging Face Documentation↗ huggingface.co

  Model cards, tokenizer/config files, embedding usage, and repository commit-hash revision pinning.

• R12Safetensors Documentation↗ huggingface.co

  Zero-copy safe tensor format overview vs. unsafe pickle deserialization risks.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsHugging Face Safetensors Documentation · reference docs
  Safetensors

  Defines the format as a JSON header plus raw tensor buffers with no executable content, which is exactly the property that removes pickle deserialization RCE from model loading.

  R12R11checked 2026-11-11
• videoYannic Kilcher · 20 min
  The hidden dangers of loading open-source AI models (ARBITRARY CODE EXPLOIT!)

  Builds a malicious model file step by step to show how a pickle __reduce__ payload executes on torch.load, the exact arbitrary-code-execution path the day asks you to reason about.

  R11R12checked 2026-11-11
• videoBlack Hat · 27 min
  Black Hat Europe 2025 | Pickle Exploitation Techniques And Their Detection Using SaferPickle

  Covers nested-pickle payloads, allowlist-based detection and the limits of static scanning, useful for judging what a pickle scanner can and cannot prove before you trust a checkpoint.

  R12checked 2026-11-11
• articleHugging Face Hub Documentation · security doc
  Pickle Scanning

  Explains how the Hub extracts GLOBAL/REDUCE opcode imports without executing them and admits the scan is not foolproof, giving you the threat-model caveats for scanner-based controls.

  R11checked 2026-11-11
• repoTrail of Bits (GitHub) · tool + CLI
  trailofbits/fickling: A Python pickling decompiler and static analyzer

  Decompiles pickle bytecode and enforces an import allowlist at load time, a hands-on way to see trust_remote_code and pickle payloads caught before deserialization.

  R12checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.