Engineering, production, governance, cost, communication · insight-1718
Treat a pickled model file as executable code and control who can write the artifact path
- Evidence type
- documented fact
- Difficulty
- medium
- Roles
- ML engineer, Data scientist
- Industries
- cross-industry
Summary: situation, action, reason, boundary
Situation
A scoring service loads a model with pickle, joblib or an unrestricted torch.load from a shared bucket or registry path that more people can write to than can deploy.
Action
Load only artifacts whose hash or signature matches the one recorded at registration, restrict write access to the registry path, and prefer code-free formats (ONNX, skops, tensor-only weights). Run unavoidable pickle loads in a process without secrets.
Reason
Python's pickle documentation says unpickling untrusted data can execute arbitrary code; scikit-learn's guide and torch.load carry matching warnings.
Boundary
Self-hosted models and pipelines that promote models by copying files.
Symptom or risk
Loading runs whatever the file contains, so one tampered or wrongly uploaded artifact becomes code execution in the serving process, with its credentials.
Exceptions
Artifacts produced and consumed inside one tightly controlled build job, never leaving it.
Trade-offs
Code-free formats may not cover custom preprocessing, which then ships as a reviewed package.
Pitfalls
Checking a hash taken from the same location as the file; assuming a weights-only flag makes every older release safe.
Example
Hypothetical: a bucket shared by 40 people holds model_v7.pkl, but only 3 may deploy. A hash pinned in the registry at promotion rejects a replaced file; a load-by-path service would run it.
Lessons and concepts
Claims and their sources
The Python pickle documentation states that the module is not secure, that malicious data can execute arbitrary code during unpickling, and suggests signing data with hmac and using safer formats for untrusted data.
scikit-learn's model persistence guide says pickle, joblib and cloudpickle have security vulnerabilities by design and should be loaded only from trusted sources, and names skops.io and ONNX as alternatives.
The PyTorch 2.14 torch.load page says it uses an unpickler, to never load data from an untrusted source, and that weights_only restricts loading to tensors, primitive types, dictionaries and registered safe types.