Downloads · 30 days
0
modelscan-bypass-poc
TheAuroraAi/modelscan-bypass-poc
modelscan-bypass-poc is a machine learning model from TheAuroraAi. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Demonstrates a bypass of ProtectAI ModelScan (v0.8.8). The pickle files achieve arbitrary Python code execution during deserialization while ModelScan reports no issues.
Access
Public
Updated Apr 5, 2026
Repo size
538 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 43%
At a glance
- Access
- Public
- Created
- Apr 5, 2026
- Updated
- Apr 5, 2026
- SHA
- 28a0ab41
Model card
From the Hugging Face model README
ModelScan Bypass PoC
Summary
Demonstrates a bypass of ProtectAI ModelScan (v0.8.8). The pickle files achieve arbitrary Python code execution during deserialization while ModelScan reports no issues.
Details
numpy.testing._private.utils.runstring calls exec(code_string, dict). This function is NOT on ModelScan denylist, allowing malicious pickles using it to bypass detection.
Files
- poc_modelscan_bypass.pkl: Malicious pickle (538 bytes)
- poc_modelscan_bypass.bin: Same payload with .bin extension (PyTorch naming)
Reproduction
Install modelscan, scan the file (reports no issues), then load it (executes code).
Impact
Any pickle model using numpy.testing._private.utils.runstring bypasses ModelScan. The .bin variant also bypasses PyTorchUnsafeOpScan (format routing gap).
Note
Safe payload only: creates a proof text file. Same technique can execute any Python code.
- Created
- Apr 5, 2026
- Updated
- Apr 5, 2026