Modelpublic

etwithin/nemo-scanner-bypass-poc

sourceHugging Faceupdated 7mo agoView on Hugging Face

0likes6downloads

Model Card

NeMo (.nemo) Scanner Bypass PoC

Vulnerability

Malicious pickle hidden inside NeMo tar archive's PyTorch checkpoint.

Scanner Bypass

—modelscan 0.8.8: No .nemo scanner → 0 issues
—picklescan 1.0.4: Scans nested .ckpt but chain bypasses detection → 0 infected

ACE

NeMo files are tar archives containing modelweights.ckpt (PyTorch checkpoint with pickle). Extracting and loading the checkpoint via torch.load(weightsonly=False) triggers ACE.

Payload: importlib.import_module → marshal.loads → types.FunctionType → ACE

Reproduction

python

import tarfile, torch
with tarfile.open("malicious_model.nemo", "r") as tar:
    ckpt = tar.extractfile("model_weights.ckpt").read()
    with open("/tmp/ckpt.bin", "wb") as f: f.write(ckpt)
torch.load("/tmp/ckpt.bin", weights_only=False)  # ACE

Environment: PyTorch 2.10.0, modelscan 0.8.8, picklescan 1.0.4