bk99.de entertain the web since 1997

bk99.de
HF · SecurityCurated

Safetensors after an independent security audit

Summary

Trail of Bits audited Safetensors as a format for storing tensors without executable deserialisation code. The results strengthened the move away from risky pickle-based weight files. Trail of Bits carried out an independent security audit of Safetensors.

Ideas

  • A data format should not be able to execute arbitrary code when weights are loaded.
  • External audits produce concrete findings, but not permanent freedom from bugs.

Insights

  • AI artefacts are active parts of the supply chain and need isolation, proof of origin and minimal privileges.

Facts

  • Safetensors then became the preferred default format in the Hub ecosystem.

Critique

  • The secure container format says nothing about malicious functions or backdoors in the weights themselves.

Recommendations

  • Prefer Safetensors and treat foreign pickle files like executable code.

References

Read the original article on Hugging Face

Search the Web Archive

HF · 2026

Security incident at Hugging Face in July 2026

Hugging Face describes a break-in in which an autonomous agent combined a prepared data source with insecure execution paths. Internal data sets and credentials were reached; according to what was known at the time, public Hub artefacts were not manipulated. The attack combined a malicious data set with remote code execution and template injection.

HF · 2026

Why open AI matters for cybersecurity

The article argues that open models give defenders tools they can inspect and adapt. At the same time, it acknowledges that the same capabilities are available to attackers. Open weights allow local analysis without handing sensitive data to an API provider.

HF · 2024

The security architecture of Gradio 5

The security overview describes changes to file paths, network access and browser boundaries in Gradio 5. Public ML demos are thereby explicitly treated as web applications with an attack surface. Gradio 5 tightens the handling of accessible files and paths.