An ML engineer at a startup downloads a pre-trained text classification model from a GitHub repository to use as a base for their product. The model is distributed as 'model.pt'. Before running the code snippet 'model = torch.load("model.pt")', a senior security engineer who joined a code review notices the file extension and asks the team to stop before executing.
A machine learning engineer downloads a pre-trained transformer model as a .pt file from a community repository. A security reviewer raises a concern before the engineer runs torch.load(). What is the specific risk?
- A.B. PyTorch's torch.load() uses Python pickle deserialization, which can execute arbitrary code embedded in the model file by an attacker
- B.A. The .pt file may be too large to fit in GPU memory, causing training to fail
- C.C. The .pt file format is unencrypted, exposing model weights to network interception
- D.D. The model may have been trained on a different hardware architecture and will produce incorrect results
Why A is correct
PyTorch's default torch.load() uses Python pickle, which executes arbitrary Python code via __reduce__ during deserialization. An attacker can craft a .pt file that spawns a reverse shell or downloads malware when loaded. This is a well-documented ML supply chain attack vector. The safe alternative is safetensors format or using torch.load() with weights_only=True (PyTorch 2.x). Options A, C, and D are not the security concern here.
Know someone studying for AI Security Fundamentals? Send them this one.