Add weights_only=True in torch.load #6094
Conversation
terry-for-github
requested review from
tjruwase,
awan-10,
arashb and
loadams
as code owners
|
I didnt check which case should not use weights_only=True. I just add it in all of the torch.load. Hope it will help. |
@terry-for-github, thanks for making DeepSpeed more secure. |
| @@ -116,7 +116,7 @@ def show_transformer_file_map(self): | |||
| self._dump_mapping(self.transformer_file_map, 'rank_to_transformer_files') | |||
|
|
|||
| def _build_global_state(self): | |||
| sd = torch.load(self.mp_rank_files[0], map_location=torch.device('cpu')) | |||
There was a problem hiding this comment.
Hi @terry-for-github - could you run the pre-commit formatter, that should fix the formatting errors on these files.
There was a problem hiding this comment.
ok, I'll try that.
…erry-for-github/DeepSpeed into torch_load_weight_only_warning
|
Is this OK? I haven't use pre-commit tools brefore. I do it by myself lol. |
Yes @terry-for-github thanks, the formatting checks appear to be passing, though other checks are not now. |
|
I found that not all of the |
Agreed, we've fixed most of the unrelated CI issues, would you be interested in continuing this PR? |
Hi @terry-for-github - no worries if you aren't, but I'll make a PR as well to fix these warnings. |
|
Closing in favor of #6751 |
Successor PR to #6094: > FutureWarning: You are using torch.load with weights_only=False (the current default value), which uses the default pickle module implicitly. It is possible to construct malicious pickle data which will execute arbitrary code during unpickling (See https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models for more details). In a future release, the default value for weights_only will be flipped to True. This limits the functions that could be executed during unpickling. Arbitrary objects will no longer be allowed to be loaded via this mode unless they are explicitly allowlisted by the user via torch.serialization.add_safe_globals. We recommend you start setting weights_only=True for any use case where you don't have full control of the loaded file. Please open an issue on GitHub for any issues related to this experimental feature. Todo: - [ ] Update values in non-test files to True where necessary.
FutureWarning: You are using
torch.loadwithweights_only=False(the current default value), which uses the default pickle module implicitly. It is possible to construct malicious pickle data which will execute arbitrary code during unpickling (See https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models for more details). In a future release, the default value forweights_onlywill be flipped toTrue. This limits the functions that could be executed during unpickling. Arbitrary objects will no longer be allowed to be loaded via this mode unless they are explicitly allowlisted by the user viatorch.serialization.add_safe_globals. We recommend you start settingweights_only=Truefor any use case where you don't have full control of the loaded file. Please open an issue on GitHub for any issues related to this experimental feature.