Authorize an artifact before interpreting its model representation
Distinguish tensor-format restrictions, restricted unpickling, executable model code, artifact identity, and the remaining runtime trust boundary.
On this page
The question for today
What you’ll understand
- Separate artifact identity from deployment authorization.
- Describe the pinned weights_only and safetensors boundaries without universal safety claims.
- Keep model code, dependencies, runtime isolation, and resource policy in the admission decision.
A model package crosses several boundaries before it serves a prediction: downloaded bytes become parsed metadata, tensors, model code, and device work. A digest can identify those bytes, while a tensor-oriented format can constrain how they are represented. Neither fact establishes that a particular tenant or service should execute the package. Define who approves the artifact, which code is already trusted, and what the loader is allowed to interpret. Security depends on the entire selected path rather than a reassuring filename extension.
Treat integrity and permission as separate predicates
Compute a digest over the exact artifact selected for loading and compare it with a value obtained through an authenticated, approved manifest. A digest copied from the same untrusted upload only confirms self-consistency. Even a verified signature identifies a statement by a signer under a trust policy; it does not independently decide whether this model, version, or deployment action is permitted. Bind approval to immutable artifact identity, code/configuration versions, tenant scope, and the allowed serving environment.
Checking one file and later reopening a mutable path creates a gap between the approved bytes and the consumed bytes. Use a controlled immutable artifact or equivalent verified-content mechanism through the actual load. A proposed admission predicate should fail when any required component is missing. Keep its decisions auditable, including why an artifact was rejected, without exposing confidential weights or credentials. This is an application design contract, not a guarantee automatically provided by the storage service or a digest algorithm.
Name exactly what the pinned loading mechanism restricts
PyTorch 2.9 documents weights_only=True as restricting unpickling to supported tensor state and selected primitive or allowlisted types, without dynamic imports during that restricted unpickling. Specify the option explicitly at controlled call sites rather than depending only on a default. An unsupported global should trigger a review of the artifact contract; automatically retrying with weights_only=False or broadly extending the allowlist defeats that intended boundary. Static inspection of globals is also not a complete execution or resource-risk proof.
Safetensors v0.5.3 separates a JSON metadata header from tensor bytes and validates shape/dtype/offset consistency in its implementation. It does not encode arbitrary pickle object reconstruction as its tensor representation. That narrower representation does not make surrounding Python model code, parser implementations, device kernels, or future inference behavior universally safe. Transformers 4.57.1 separately documents trust_remote_code for custom repository code. Turning it on is a code-trust decision even when the associated weights use a tensor-oriented format.
Test each boundary without executing an unknown package
Use controlled fixtures to verify the declared loader configuration, unsupported-format rejection, unapproved version denial, and immutable-content comparison. Include a benign tensor file paired with disallowed custom code to show why format approval alone is insufficient. Record pinned library versions and approved code revisions. The loader should have only the filesystem, network, and device privileges it needs; a container label alone does not establish the isolation properties. Resource limits and operational patching remain separate controls.
The probability lab supports only a hypothetical preflight workload count. Reset, set both p=0.8,n=10, predict eight expected qualifying artifacts, then Play or Step. Reset and set both p=0.5,n=10 for five. These are exact binomial expectations under independent identical qualification assumptions, not a measurement of malicious-artifact prevalence or loader security. The instrument parses no files and verifies no digests, signatures, code approvals, or permissions. Use actual negative fixtures for those properties.
Work it through
Count tensor payload without granting deployment permission
A fictional approved manifest describes a single contiguous tensor with shape [1,024,1,024], two bytes per element, and an exact content digest. The uploaded file matches the digest, but its requested tenant deployment is absent from the authorization policy. Count the payload and decide the admission outcome.
The tensor has 1024×1024=1,048,576 elements. At two bytes each, its dense payload is 2,097,152 bytes, exactly 2 MiB.
The digest match establishes the selected content identity under the manifest assumption. The size and format checks can be evaluated separately; neither supplies the missing tenant permission.
The proposed deny-by-default policy rejects this deployment because its authorization predicate is false. A valid tensor and matching digest do not override that result or approve any accompanying executable code.
The counted payload is 2 MiB, and deployment remains denied under the stated policy. Identity, representation, resource cost and authorization answer different questions.
The living notebook
Explore the model
Interactive lab · probability
Count a hypothetical review workload without estimating exploit risk
Fresh Reset → set both p=0.8,n=10 predicts mean count 8; Reset → set both p=0.5,n=10 predicts 5. Play/Step highlights exact binomial outcomes. No files, loaders, digests, signatures, code execution or authorization are tested; qualification probabilities are stipulated independent toy inputs.
- Mean · np
- 5
- Variance · np(1−p)
- 2.5
- Total probability
- 1
These are exact binomial probabilities for independent trials with one fixed success probability. Playback tours the distribution; it does not resample outcomes. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.
Look forA count model can size a hypothetical workflow but cannot certify the loader or the artifact.
Pause & reason
Check your understanding
Your turn
Try it yourself
A [512,256] float32 tensor uses four bytes per element. What is its dense payload in bytes and KiB? Would renaming an unrestricted pickle file with a .safetensors suffix establish the required format?
Take a moment to make a prediction or work it out on paper. Open a hint when you need one.
Give me a hint
Multiply dimensions by element width, then distinguish a filename from parsing under a pinned format contract.
Compare with the solution
The payload is 512×256×4=524,288 bytes, or 512 KiB. A renamed file has not become safetensors: the selected parser must validate the actual representation, and the application must reject disallowed or malformed formats. Even a valid tensor payload still needs approved provenance, code/configuration policy, permission and resource checks. The byte count excludes other stored tensors and runtime allocations.
Keep the idea
Take it with you
- Bind approval to the exact consumed content and its deployment context.
- Restricted representations narrow one interpretation boundary without authorizing surrounding code.
- Keep parser configuration, resource isolation and negative fixtures explicit.
Read further
Original sources and deeper explanations to follow at your own pace.
Optional progress, saved in this browser when available. Revisit any lesson at any time.
Lesson not marked complete.