Lion Cipher Lab
Sign and verify an ML model with Sigstore
- AI Security
- Advanced
- ~60 min
- Free · no account required
Why it matters
You download models the same way you download code: an opaque file from a hub, trusted on faith. But the classic Python pickle format runs arbitrary code the instant you load it, so a poisoned model file is remote code execution the moment torch.load touches it -- and even a safe file gives you no proof of WHO published it or that it was not swapped in transit. Signing a model artifact with Sigstore ties it to a real published identity and a public tamper-evident log, so a load-time policy can refuse anything unsigned or signed by the wrong person. This is the seatbelt for the ML supply…
What you'll learn
- Saving/loading a model in safetensors and why it beats pickle
- The pickle deserialization RCE risk (defensive understanding)
- Sigstore keyless signing (Fulcio certificate + OIDC identity)
- The Rekor transparency log and why it matters
- Verifying a model against an expected signer identity + issuer
- Model transparency / provenance and its limits vs safety
Steps in this lab
- The threat: a model file is code you run on faith
- Set up a clean workspace
- Save a model the SAFE way: safetensors
- What keyless signing actually is (define every term)
- Sign the model file (keyless, via your identity)
- Verify against the EXPECTED identity (the success case)
- Break it on purpose #1: flip a byte
- Break it on purpose #2: demand the wrong identity
- From one file to a whole model: transparency & provenance
- The judgment: a signature is not a safety certificate