Lion Cipher Lab
Verify an AI model's provenance before you load it (hands-on)
- AI Security
- Intermediate
- ~40 min
- Free · no account required
Why it matters
It is one thing to know you SHOULD check a model before running it; it is another to actually be able to. When you download model weights from a public hub, you are trusting that the file is what the publisher released and that loading it won't run someone else's code on your machine. Both of those are checkable in minutes with tools you already have. A hash tells you the file wasn't altered in transit or swapped for a poisoned copy. Disassembling a pickle shows you, concretely, why the default PyTorch weight format can execute code the instant it loads — the exact mechanism behind real…
What you'll learn
- computing a file's SHA-256 hash and comparing it to a publisher's value
- disassembling a pickle with pickletools to see why loading it can run code
- scanning a model file for unsafe deserialization with picklescan
- recognising safetensors as a code-execution-free format and why
- telling integrity (a hash) apart from origin (a signature)
- running a repeatable verify-before-you-load routine on a downloaded model
Steps in this lab
- From 'know what to check' to actually checking it — and the words for it
- See why loading a pickle can run code — safely, on a file you made
- Prefer safetensors — and know why it cannot run code
- Verify integrity: compute the file's SHA-256 and compare it to the publisher's
- Scan for unsafe deserialization with picklescan
- Integrity vs origin: what a hash proves, what a signature proves, and where the model card fits
- Your verify-before-you-load routine — and why this is the habit that matters