safetensors-zip-polyglot-payload-smuggling

safetensors-zip-polyglot-payload-smuggling

This repository contains a proof of concept for hidden payload smuggling inside a valid .safetensors file.

Vulnerability

A single file can be both:

• a valid .safetensors file accepted by official safetensors loaders, and
• a valid ZIP archive accepted by generic archive tooling

This breaks a common security expectation around .safetensors as a non-polyglot carrier.

The included artifact embeds an actual malicious .joblib payload inside the ZIP portion. The outer file still parses as a normal safetensors file, while archive-aware tooling can later extract the hidden second-stage payload and trigger it.

Primary PoC

The main PoC file is:

• artifacts/carrier.safetensors

The embedded payload is harmless. When the hidden .joblib is extracted and loaded, it creates a local marker file:

• INNER_JOBLIB_MARKER.txt

Included Files

• artifacts/carrier.safetensors
• artifacts/reproduce_output.txt
• artifacts/sha256sums.txt
• reproduce.py

Tested Environment

• Date tested: July 16, 2026
• Python: 3.13.12
• safetensors: 0.8.0
• huggingface_hub: used to verify official local safetensors metadata parsing

Reproduction

1. Verify the included PoC

Run:

python reproduce.py

Expected results:

• safe_open(...) accepts the file as a normal safetensors artifact
• zipfile.is_zipfile(...) returns True
• ZIP members include payload/embedded.joblib
• if huggingface_hub is installed, its local safetensors parser also returns ordinary metadata
• extracting and loading the inner .joblib creates the marker file

2. Rebuild the artifact from source logic

Run:

python reproduce.py --build

This regenerates artifacts/carrier.safetensors and reruns the verification steps.

Observed Results

From artifacts/reproduce_output.txt:

• safe_open_keys: ['archive']
• safe_open_metadata: {'format': 'np'}
• zipfile.is_zipfile: True
• zip_names: ['payload/embedded.joblib']
• file_1_output: Zip archive, with extra data prepended
• hf_metadata: {'format': 'np'}
• hf_tensor_names: ['archive']
• marker_exists_after_joblib_load: True

Impact

This is a practical payload smuggling primitive for a supported high-value format:

• the outer file passes as a normal safetensors model
• header-only safetensors parsers only see ordinary tensor metadata
• the same file still hides a second-stage archive payload
• the hidden payload can itself be another malicious model artifact

Notes

• This is not load-time ACE in safetensors itself.
• The security issue is that a supported .safetensors file can act as a concealed transport carrier for a second malicious artifact.