Downloads · 30 days
0
modelaudit-numpy-savez-filewrite-poc
celvexgroup/modelaudit-numpy-savez-filewrite-poc
modelaudit-numpy-savez-filewrite-poc is a machine learning model from celvexgroup. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only.
Access
Public
Updated Jul 16, 2026
Repo size
144 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
.py3 KB · 53%
At a glance
- Access
- Public
- Created
- Jul 16, 2026
- Updated
- Jul 16, 2026
- SHA
- cba4a3ad
Model card
From the Hugging Face model README
PoC - modelaudit misses numpy.savez file-write-on-load (Pickle)
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only.
- Scanner under test:
modelaudit==0.2.49(cross-checkedmodelscan==0.8.8), Python 3.11.15, numpy 2.4.6. - Format: Pickle (.pkl).
- Two-sided behavior:
modelaudit scan evil_savez.pkl-> Clean / exit 0 (7/7 checks pass), butpickle.load(open('evil_savez.pkl','rb'))writes a.npzto an attacker-controlled absolute path on load. - Benign marker: the reduce calls
numpy.savez(<marker_path>, [13.37])- a harmless array write. No destructive action. - Root cause: modelaudit's pickle FILE_WRITE call-graph sink table (
_FILE_OPEN_SINK_EXACT) omitszipfile.ZipFile, sonumpy.savez/savez_compressed(whose open is mediated by zipfile) evade the detector that catchesnumpy.save.
Files: evil_savez.pkl (scan Clean), build_gadgets.py (builder). Full report + positive control in the huntr submission.
- Created
- Jul 16, 2026
- Updated
- Jul 16, 2026