Ml Security

ML Model Security

Model artifact loading (pickle vs safetensors), model & data poisoning, PII in training data, secrets in notebooks, model provenance / lineage

ALWAYS

• When loading models, use safetensors for PyTorch and Hugging Face; use weights_only=True with torch.load on PyTorch 2.4+; never load arbitrary .pkl / .pt files from untrusted sources.
• Verify provenance / lineage of any third-party or externally fine-tuned model — known author, signed or hashed checkpoint, recorded source — before loading it.
• Pin and hash model + dataset versions and record them, so a poisoned artifact can be traced and rolled back.
• Scrub PII, credentials, and secrets from training / fine-tuning data — at the source (ingestion), at storage (encryption + access control), and in anything committed to the repo.
• Treat ML notebooks as code: no plaintext credentials in cells or cell output, and clear outputs before committing.

NEVER

• pickle.loads / joblib.load / dill.loads / torch.load an artifact fetched at runtime from an untrusted source. These deserializers execute arbitrary code by design.
• Use a model fine-tuned or distributed by an external party without provenance / lineage verification.
• Store training-data examples that contain PII in long-term storage without explicit consent, retention windows, and deletion APIs.
• Hard-code OpenAI / Anthropic / Cohere API keys in notebooks or repo files. Use environment variables and the secret-detection skill.
• Commit synthetic or generated training data without labeling it and reviewing it for inadvertent PII or leaked secrets.

KNOWN FALSE POSITIVES

• Pre-publication academic models from trusted authors are often distributed as .pt checkpoints; convert to safetensors as a first step rather than rejecting them outright.
• Synthetic data generation pipelines may legitimately produce raw model output that is then committed — make sure it is labeled and reviewed.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ShieldNet-360
• Source: ShieldNet-360/secure-vibe
• License: MIT

Install and usage instructions live in the source repository linked above.