deserialization

AI security interview questions tagged deserialization, across every topic.

2 questions · 0 unlocked for you

Open full answer →

Open full answer →

Concepts behind "deserialization"

Explanations of the mechanisms these questions rely on.

Application SecuritySign in

Insecure DeserializationDeserialization turns bytes back into objects. Formats that can describe arbitrary objects, such as Python pickle, Java native serialization and unsafe YAML loaders, can be made to call functions during loading, so untrusted input becomes code execution. The fix is to never deserialize untrusted data with such formats: use data-only formats like JSON, safe loaders, schemas, and for machine learning, safetensors instead of pickle-based checkpoints. Signing proves origin, not safety.

Explore the full curriculum →