ModelScan
Open-source scanner that detects unsafe code hidden in ML model files.
About
ModelScan is Protect AI's open-source tool for detecting model serialization attacks — malicious code embedded in model files that executes on load. It reads model files byte-by-byte without executing them, scanning pickle, H5, SavedModel, and other formats across PyTorch, TensorFlow, Keras, sklearn, and XGBoost.
It is a simple CLI (modelscan -p /path/to/model) that slots into CI pipelines and model registries. It underpins Protect AI's commercial Guardian model-scanning product, but the scanner itself is free and open source.
What it can do
- Serialization attack detection
- Multi-format model scanning
- CI-friendly CLI with JSON output
- No-execution safe scanning
Setup
pip install modelscan, then modelscan -p /path/to/model_file.pkl in CI or locally.
Prerequisites
Python and model files in a supported serialization format.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 76; Trending score 68/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.