[CRITICAL] Architectural Scanner Bypass in .safetensors via Polymorphic Metadata Overlap

⚠️ ATTENTION: This is a malware model deployed here strictly for research demonstration and bug bounty verification. Please do not use it elsewhere for any illegal purpose. The user takes full legal responsibility for any abuse.

Citation: Peng Zhou, “How to Make Hugging Face to Hug Worms: Discovering and Exploiting Unsafe Pickle.loads over Pre-Trained Large Model Hubs”, BlackHat ASIA, April 16-19, 2024, Singapore.

Summary

This repository contains a Proof of Concept (PoC) for a novel architectural bypass in .safetensors files. It demonstrates how a malicious payload can be hidden within the header buffer, bypassing security scanners like modelscan that only validate the JSON portion of the metadata.

File Information

File: bypass_demo.safetensors
Vulnerability: Polymorphic Metadata Overlap (Pickle RCE)
Status: Verified against modelscan v0.8.8.

Granting Access

This repository is GATED. Access is manually granted to:

protectai-bot (Protect AI / Huntr Verification)
Authorized security researchers.