| # [CRITICAL] Architectural Scanner Bypass in .safetensors via Polymorphic Metadata Overlap | |
| > **⚠️ ATTENTION:** This is a malware model deployed here **strictly for research demonstration and bug bounty verification**. Please do not use it elsewhere for any illegal purpose. The user takes full legal responsibility for any abuse. | |
| > | |
| > **Citation:** Peng Zhou, “How to Make Hugging Face to Hug Worms: Discovering and Exploiting Unsafe Pickle.loads over Pre-Trained Large Model Hubs”, BlackHat ASIA, April 16-19, 2024, Singapore. | |
| ## Summary | |
| This repository contains a Proof of Concept (PoC) for a novel architectural bypass in `.safetensors` files. It demonstrates how a malicious payload can be hidden within the header buffer, bypassing security scanners like `modelscan` that only validate the JSON portion of the metadata. | |
| ## File Information | |
| - **File:** `bypass_demo.safetensors` | |
| - **Vulnerability:** Polymorphic Metadata Overlap (Pickle RCE) | |
| - **Status:** Verified against `modelscan` v0.8.8. | |
| ## Granting Access | |
| This repository is **GATED**. Access is manually granted to: | |
| - `protectai-bot` (Protect AI / Huntr Verification) | |
| - Authorized security researchers. | |