Model File Scanners Explained: ModelScan, picklescan and ModelAudit, and Why They Cannot Prove a Pickle Safe

A model file is code you did not write. Many common formats are built on Python's pickle, which can tell the loader to call functions while it reads the file, so simply loading a malicious model can run an attacker's code. Model scanners inspect those files without loading them. They are a useful control, and also a common interview trap, because a clean scan is not proof of safety.

What they are

• ModelScan comes from Protect AI, which Palo Alto Networks acquired in July 2025. It is licensed Apache-2.0, and v0.8.8 shipped in February 2026. It reads PyTorch pickles, TensorFlow SavedModel, Keras H5 and Keras V3 files, plus classic pickle, cloudpickle, dill and joblib, and looks for unsafe operators without loading the model.
• picklescan is a community project under the MIT licence. It detects pickle files that call suspicious functions, and can scan local files, URLs and Hugging Face repositories. Hugging Face uses this approach for its Hub pickle scanning.
• ModelAudit, open-sourced by promptfoo in March 2026, is another static model scanner. It outputs text, JSON or SARIF.

Commercial scanning services exist too. Hugging Face scans public repositories with Protect AI's Guardian, now part of Palo Alto Networks' Prisma AIRS, and with other partners.

How it works

These scanners read the bytes of the file and list the functions it would import or call on load, then compare them with known-dangerous operations, such as running shell commands or evaluating code. They never execute the file. That is their strength, and also their limit: a deny list misses dangerous calls it does not know about, and file-format tricks can hide calls from the scanner.

The 2025 bypasses. Sonatype reported four picklescan flaws in March 2025, fixed in version 0.0.23. JFrog reported three more in December 2025, fixed in 0.0.31. The JFrog flaws covered:

• a bypass using the file extension
• a bypass through ZIP handling
• a way around the deny list using subclass imports

Hugging Face's own documentation says its pickle scanning is "not 100% foolproof".

How to use it

Day one: scan before anything loads a model

pip install modelscan
modelscan -p ./downloaded-model/ -r json -o modelscan.json
picklescan --path ./downloaded-model/

Run scans in an isolated environment, not on a developer laptop that holds credentials. ModelScan returns 0 for clean, 1 for issues found, 2 for a scan error, 3 when no supported files were found and 4 for a usage error. Treat 2 and 3 as failures, not passes, because "nothing scanned" is not "clean".

Week one: put it in the pipeline

Add a scan step wherever a model enters your environment: when a model is pulled from a public hub, when a training job writes a checkpoint, and before a model is promoted in the registry. Record the scan result with the model's hash, so a later audit can show which exact file was checked.

Every day: prefer formats that cannot run code

Make safetensors (or another data-only format) the default, convert where you can, and require an exception for pickle-based formats. Pin models by revision hash, accept them only from trusted publishers, and keep scanners updated, because each bypass fix arrives as a new release.

Where it stops

• Deny lists are incomplete. Unknown dangerous calls and parser tricks get through; 2025 produced several real examples.
• Code, not behaviour. Scanners look for load-time code execution. They do not find backdoors trained into the weights or harmful model behaviour.
• Format coverage varies. Unsupported formats are skipped, which is why "no supported files" must fail the check.
• Archived siblings. Protect AI's LLM Guard library was archived in July 2026; check maintenance status before depending on any AI security library.

How it comes up in interviews

• "A data scientist wants to load a model from an unknown Hugging Face account. What do you require?" An isolated scan, a data-only format, a pinned revision, a trusted source and an exception process.
• "Our model scanner passed the file. Are we safe?" Explain deny-list limits and the 2025 bypasses.
• "Where in the ML pipeline do you scan?" At ingestion, after training, and before promotion and deployment.

Sources

Checked on 13 November 2026: ModelScan GitHub README (protectai/modelscan); picklescan GitHub README (mmaitre314/picklescan); Hugging Face Hub documentation on pickle scanning and on Protect AI scanning; Sonatype blog on four picklescan vulnerabilities (March 2025); JFrog blog on three picklescan zero-days (December 2025); promptfoo blog on open-sourcing ModelAudit (3 March 2026); Palo Alto Networks press release on completing the Protect AI acquisition (22 July 2025); LLM Guard GitHub repository archive notice.