Skip to content

fix(picklescan): safely parse bounded PyTorch tensor batches #1783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mldangelo-oai wants to merge 32 commits into
base: main
Choose a base branch
from
Open

fix(picklescan): safely parse bounded PyTorch tensor batches #1783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
c49fdac
fix: avoid false positives for batched PyTorch state dictionaries
mldangelo-oai Jul 27, 2026
6ab180a
fix: require patched picklescan and preserve Ruff policy
mldangelo-oai Jul 27, 2026
117dc52
fix: stream bounded canonical tensor dictionary batches
mldangelo-oai Jul 27, 2026
662ee8b
fix(picklescan): preserve release order and mixed tensor batches
mldangelo-oai Jul 27, 2026
165da93
fix(picklescan): retain bounded mixed checkpoint state
mldangelo-oai Jul 27, 2026
b6e5500
fix(picklescan): retain malicious storage detection for wide dictiona…
mldangelo-oai Jul 27, 2026
8c1de87
fix(picklescan): validate post-tensor metadata without trusting storage
mldangelo-oai Jul 27, 2026
5accbc4
fix(picklescan): reject transformed untrusted storage in tensor batches
mldangelo-oai Jul 27, 2026
6acec3c
fix(picklescan): distrust discarded persistent storage references
mldangelo-oai Jul 27, 2026
a2f6598
fix(picklescan): bound provenance and preserve discarded storage cove…
mldangelo-oai Jul 27, 2026
fc0cb23
fix(picklescan): distrust duplicate provenance in ordered state dicti…
mldangelo-oai Jul 27, 2026
d394b41
fix(picklescan): distrust storage consumed by build and conversion re…
mldangelo-oai Jul 27, 2026
a9b5322
fix(picklescan): retain coverage when malformed stacks discard storage
mldangelo-oai Jul 27, 2026
1ae8668
fix(picklescan): preserve discarded compacted tensor provenance
mldangelo-oai Jul 27, 2026
5f68a46
fix(picklescan): retain storage operands discarded by mutation opcodes
mldangelo-oai Jul 27, 2026
37ac497
fix(picklescan): reject raw storage injected into canonical tensor state
mldangelo-oai Jul 27, 2026
48d2778
fix(picklescan): track storage nested before canonical tensor batches
mldangelo-oai Jul 27, 2026
119697c
fix: retain untrusted storage provenance in plain dictionaries
mldangelo-oai Jul 27, 2026
96ed814
fix: buffer safe metadata before canonical tensor batches
mldangelo-oai Jul 27, 2026
e9cb6a8
fix: bound dictionary storage provenance without retaining containers
mldangelo-oai Jul 27, 2026
d6f6771
fix: preserve safe repeated tensor memo references
mldangelo-oai Jul 27, 2026
fd602ee
fix: preserve canonical state across realistic metadata layouts
mldangelo-oai Jul 27, 2026
2bdd951
fix: preserve storage provenance across enclosing containers
mldangelo-oai Jul 27, 2026
fcd0e42
fix: inspect every nested storage provenance entry
mldangelo-oai Jul 27, 2026
7081570
Merge remote-tracking branch 'origin/main' into fix/hf-pytorch-batche…
mldangelo-oai Jul 27, 2026
9c2735c
fix: validate final storage and bounded nested tensor state
mldangelo-oai Jul 27, 2026
3e5b248
fix: preserve direct size-proven storage payload coverage
mldangelo-oai Jul 27, 2026
46a8fb7
fix: preserve bounded storage discovery across compacted tensor batches
mldangelo-oai Jul 27, 2026
d9f9103
fix: retain storage containers and probe every expanded tensor batch
mldangelo-oai Jul 27, 2026
9226edd
fix: bound expanded tensor-storage prefix probes
mldangelo-oai Jul 27, 2026
5c56a10
chore(picklescan): drop unrelated ruff select override
mldangelo Aug 1, 2026
21bc219
fix(picklescan): keep the expanded storage probe additive for coverage
mldangelo Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/modelaudit-picklescan/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@ and this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Bug Fixes

- Validate bounded batched PyTorch state-dictionary entries without falsely flagging canonical tensor reconstruction.
- Keep scanning storage members between the trusted and expanded pickle probe sizes.

## [0.1.10](https://github.com/promptfoo/modelaudit/compare/modelaudit-picklescan-v0.1.9...modelaudit-picklescan-v0.1.10) (2026-07-22)

### Bug Fixes
Expand Down
Loading
Loading