A Model File Is Part of the Software Supply Chain

Object Reconstruction Can Execute Behaviour

BOTIE

Python programmers wanted to save an object and reconstruct it later, including the state its class needed. Pickle saves those objects. Rebuilding an object is more powerful than reading a list of numbers: reconstruction can invoke Python behaviour. A saved preprocessing object therefore brings a different loading question from a plain table of coefficients.

The 2003 PEP 307 proposal extended the pickle protocol and explicitly rejected earlier checks that had suggested untrusted unpickling could be made safe. Its warning was to avoid loading pickles from untrusted or unauthenticated sources. That history matters when a model file arrives as an apparently passive download. We will check its bytes against an independently trusted expectation before loading anything; a matching digest still leaves the choice and constraints of the loader to be reviewed.

Sources for this history

Loading the Weights Started Running Code

Botie downloads a model artifact. The file looks like data, but some Python serialisation formats can execute instructions while loading. Running it to discover whether it is trustworthy puts the check after the dangerous step.

We need to know which bytes were approved and what the loader is allowed to do. Integrity, publisher trust and safe loading are related checks with different jobs.

The flags are already resolved teaching inputs. Real verification and isolation must occur outside untrusted code.

Step 1 of 1

Keep the checks separate

The fixture supplies outcomes from independent checks.

Only A passes this simplified release gate. Neither flag is supplied by the model itself.
Artifact	Trusted digest matches	Approved loader policy
A	1	1
B	0	1
C	1	0

A
Trusted digest matches
1
Approved loader policy
1
B
Trusted digest matches
0
Approved loader policy
1
C
Trusted digest matches
1
Approved loader policy
0

Only A passes this simplified release gate. Neither flag is supplied by the model itself.

Verify bytes before interpreting them

Passing one check cannot replace the other.

Gate loading on independent evidence

A model artifact needs both trusted byte verification and an accepted loading path.

BOTIE

A model artifact needs both trusted byte verification and an accepted loading path.

Choose an example

Artifact IDs

1

Trusted manifest verification flags

1

Approved loader-policy flags

1

Artifacts meeting both supplied release checks

0A

Follow the operations

1. Artifact IDs
1. 0A
2. Trusted manifest verification flags
1. 01
3. Approved loader-policy flags
1. 01
4. Multiply
1. 01
5. Select real entries
1. 0A
6. Result
1. 0A

The flags are already resolved teaching inputs. Real verification and isolation must occur outside untrusted code.

1. Verify bytes before interpreting them

A cryptographic hash maps file bytes to a digest. Compare the downloaded bytes with a digest from a trusted manifest or a verified publisher-signing process. A digest downloaded from the same untrusted location is not independent provenance.

Read bytes as bytes while checking. Do not load a pickle first and inspect it afterwards.

Integrity says the bytes match an expectation. It does not establish that the expected artifact is harmless.

2. Constrain the loading path

Prefer formats and loaders with the narrowest behaviour needed for the artifact. Disable remote custom-code execution unless it is explicitly reviewed and required. Limit resource use because malformed or huge data can still exhaust memory.

A signature authenticates a publisher under a trust policy. It does not remove the need to review that publisher’s artifact and dependencies.

The workshop combines resolved verification and loader-policy flags. It does not implement signatures or sandboxing.

Hash bytes without interpreting them

The bytes are passed to a digest function rather than an object loader.

Python

import hashlib
print(hashlib.sha256(b"abc").hexdigest())

Output

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Comparison is useful only when the expected digest comes from a trusted provenance process.

Check yourself

What does a matching digest establish?

Question 1 of 2

What is still missing?

Use the information below.

Artifact bytes match a digest supplied by the same untrusted download page.

3. Bind approval to the exact artifact

Record the digest, format, loader version and relevant dependencies with approval. A replacement file or changed loader can invalidate that review. Use an immutable artifact reference in serving.

When a model is withdrawn, lineage identifies affected deployments. Stop new loads and plan replacement rather than merely deleting the download link.

An already running process may still hold the model, and cached copies may still exist.

4. Test the verifier without loading the file

Change one byte and require a mismatch. Check an empty file and a known digest. Keep the expected digest outside the untrusted artifact.

The Python exercise verifies bytes only. No challenge needs to execute an untrusted artifact to demonstrate this boundary.

The safe boundary is the order of operations as much as the individual checks.