PoC - modelaudit misses numpy.savez file-write-on-load (Pickle)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only.

Scanner under test: modelaudit==0.2.49 (cross-checked modelscan==0.8.8), Python 3.11.15, numpy 2.4.6.
Format: Pickle (.pkl).
Two-sided behavior: modelaudit scan evil_savez.pkl -> Clean / exit 0 (7/7 checks pass), but pickle.load(open('evil_savez.pkl','rb')) writes a .npz to an attacker-controlled absolute path on load.
Benign marker: the reduce calls numpy.savez(<marker_path>, [13.37]) - a harmless array write. No destructive action.
Root cause: modelaudit's pickle FILE_WRITE call-graph sink table (_FILE_OPEN_SINK_EXACT) omits zipfile.ZipFile, so numpy.savez/savez_compressed (whose open is mediated by zipfile) evade the detector that catches numpy.save.

Files: evil_savez.pkl (scan Clean), build_gadgets.py (builder). Full report + positive control in the huntr submission.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support