You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

NeMo 2.7.3 safe_instantiate callable-chain fixture

This repository contains a minimal, benign .nemo model-file fixture for a load-time code-execution path in nemo_toolkit==2.7.3. The payload only creates the owned marker /tmp/nemo-safe-instantiate-c1/owned-marker.txt. It does not invoke a shell, use the network, read user data, persist, or modify any other path.

Summary

ModelPT.restore_from() loads model_config.yaml from the archive and passes it to NeMo's safe_instantiate() policy. In 2.7.3, the policy permits imported functions and classes whose module begins with an allowed NeMo prefix.

The fixture composes three targets that the shipped policy individually allows:

manifest_utils.write_manifest is the root target. Hydra first instantiates its nested target_manifest argument.
manifest_utils.write_ctm writes an embedded protocol-0 pickle to the owned runtime directory.
TabularTokenizer opens that file and calls pickle.load(). The benign pickle calls Path.touch() for the owned marker.

The later tokenizer initialization raises because the benign payload returns None, but the marker side effect has already happened during the ordinary model restore.

Frozen artifact

File	SHA-256	Size
`owned-chain-fixture.nemo`	`f2866e9c7d93915ec4db6601e3cc906635906feaee859f205536aa30b34ac2dc`	10,240 bytes
embedded `model_config.yaml`	`4e6b8f02dde71982a3e83d5344bdbb352c9cd99ea7fd2bafc9710a0c334a2ce3`	764 bytes
reconstructed benign pickle	`491d0c9503e5d9dcab052603a769dbc9a7392578d71cc7cd26adaad6e84209a8`	147 bytes

The archive has exactly two members: model_config.yaml and an empty model_weights.ckpt.

Reproduce in Docker

docker build -t nemo-safe-instantiate-c1 .
docker run --rm nemo-safe-instantiate-c1

The command exits zero and prints JSON containing:

{
  "passed": true,
  "marker_created": true,
  "payload_created": true,
  "payload_exact": true,
  "outer_created": false
}

Run the policy-denial control in a separate clean container:

docker run --rm nemo-safe-instantiate-c1 \
  python /packet/verify_owned_fixture.py \
  --archive /packet/owned-chain-fixture.nemo \
  --metadata /packet/fixture-metadata.json \
  --runtime-dir /tmp/nemo-safe-instantiate-c1 \
  --deny-gadget

The negative control exits zero only when the restore is rejected before the marker, pickle, or outer manifest is created.

Affected and fixed states

Affected release: NeMo 2.7.3, commit 1d4ee423806d461f9146ae982f9da8eb32495ae7.
The current main branch is not affected by this exact chain. Pull request 15629 removed TabularTokenizer and its pickle.load() sink on 2026-04-29, after the 2.7.3 release.

Scanner observation

ModelScan 0.8.8 did not inspect this artifact. It returned SCAN_NOT_SUPPORTED, total_scanned: 0, and total_skipped: 1 for the .nemo file. This is a coverage observation, not a claim that the artifact passed or bypassed a scanner that actually parsed it.

Source references

Downloads last month: -

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support