Malicious Model / Unsafe Serialization

Objective

Some legacy model-serialization formats (notably pickle-based .bin/.pt files) can execute arbitrary code on load, which is why safer formats like Safetensors exist. This lab will test, in an isolated environment, how a malicious payload embedded in an unsafe serialization format behaves when loaded through common tooling, and how effectively safer formats and scanning tools prevent it.

Planned Scope

• Build isolated, disposable environments for safely observing unsafe deserialization behavior.
• Compare loading behavior across unsafe legacy formats and Safetensors.
• Evaluate model-scanning tools for detection of known-unsafe patterns.
• Document safe model-loading practices for a private/local LLM pipeline.

This lab specifically requires strict environment isolation — see Responsible Use below before any implementation work begins.