01 · Security × Machine Learning
Aegis-Tensor
Is this model file safe to load? One verdict, before a single byte of it runs.
The problem
People download open-weight models from strangers and run them locally. A model file can carry a code-execution payload in its pickle, a template injection in its chat template, or data hidden in the low bits of its weights. Most tools either load the file to inspect it, which is the attack, or check one format.
How it works
- 01 · read
Read, never load
Headers, opcodes and tensor bytes are parsed directly. Every malicious test fixture would drop a marker file if it ran; the tests check the marker is never there.
- 02 · resolve
Resolve what the pickle would call
The pickle stream is walked like a VM: memo PUT/GET, STACK_GLOBAL and calls on call results, so os.system assembled from fragments is still os.system.
- 03 · measure
Measure the weights
Float tensors are checked for overwrites, injected NaN/Inf and structure in the least significant mantissa bits.
- 04 · disarm
Disarm regardless
Detection is not the safety net. Disarm zeroes the rounded-away bits for every tensor and refuses any width that would reach the exponent.
What I built
- A static scanner for safetensors, GGUF, PyTorch and pickle checkpoints, numpy, Keras and ONNX that never executes the file it reads.
- A pickle analyser that follows memoised strings and runtime-built callables, so payloads assembled in pieces are still resolved.
- Statistical checks for overwritten tensors, NaN/Inf injection and structured data hidden in mantissa bits.
- aegis disarm, which rounds away the low mantissa bits whether or not a payload was detected, because the rules are public and a payload can be tuned to sit under any threshold.