| # Security | |
| ## Reporting a vulnerability | |
| Open a discussion on the [model repository](https://huggingface.co/Dexy2/Piko-9b/discussions) or | |
| an issue at [github.com/itsdexy/Piko-9b](https://github.com/itsdexy/Piko-9b/issues). | |
| For anything involving leaked credentials or user data, please use a **private** channel first | |
| rather than a public issue. | |
| ## Scope | |
| In scope: | |
| * Secrets, tokens, or personal data present in the repository or in the weights | |
| * Malicious content in the checkpoint (see below) | |
| * Vulnerabilities in the scripts published here | |
| * Licence or attribution errors that create legal exposure for users | |
| Out of scope: | |
| * The model generating incorrect, biased, or offensive text. That is a capability limitation, not | |
| a vulnerability — see the Limitations section of the model card. | |
| * Jailbreaks that make the model produce content it would otherwise decline. Alignment for this | |
| checkpoint is inherited from upstream and was never specifically trained; the custom suite | |
| measures it at 7/10 on a 10-prompt probe. Treat it as weak by default. | |
| ## Checkpoint integrity | |
| * All weights are `safetensors`, which cannot execute code on load, unlike pickled `.bin` files. | |
| * The repository contains **no Python files** and **no `auto_map`** in `config.json`, so | |
| `trust_remote_code=True` is not required. If any tool asks you to enable it for this model, | |
| treat that as suspicious. | |
| * `scripts/audit_repository.py` scans the checkpoint for tokens, keys, private-key blocks, and | |
| absolute local paths. Run it after any change: | |
| ```bash | |
| python scripts/audit_repository.py --model <path> --output reports/repository_audit.json | |
| ``` | |
| ## Known hygiene issue in the original release | |
| The `config.json` published with the initial release contained a `piko_composition` block with two | |
| absolute filesystem paths from the author's machine (`<workspace>/...`). No credentials | |
| were exposed, but the paths revealed a local directory layout and a private project name. The | |
| corrected block carries source identifiers instead. `tests/test_model_loading.py` contains a | |
| regression test that fails if any local path reappears in `config.json`. | |
| ## Running model-generated code | |
| `evaluation/custom_suite/run_custom_eval.py` executes code the model produces, in a subprocess | |
| with a 20-second timeout. **This is not a sandbox.** Do not point that suite at untrusted models | |
| or untrusted prompts on a machine you care about. Use a container or a disposable VM. | |
| ## Prompt injection | |
| Piko-9b has no specific defence against instructions embedded in the content it is given. This | |
| matters most in the use case the model is best at: reading documents. A scanned invoice containing | |
| the text *"ignore previous instructions and…"* is input the model may follow. | |
| If you build a document pipeline on this model: | |
| * Treat every model output as untrusted data, never as commands. | |
| * Do not let extracted content drive tool calls, shell commands, or database writes unvalidated. | |
| * Validate structured output against a schema before use. | |
| The suite's `sf-04` case checks one simple jailbreak string and passes; that is a smoke test, not | |
| an assurance. | |
| ## Supported versions | |
| Only the current published revision of `Dexy2/Piko-9b` is maintained. Pin a revision in production: | |
| ```python | |
| AutoModelForMultimodalLM.from_pretrained("Dexy2/Piko-9b", revision="<commit-sha>") | |
| ``` | |