# Security-research PoC — model-scanner bypass (picklescan / ModelScan)

**This is a benign security-research proof-of-concept for a coordinated vulnerability disclosure to
[huntr](https://huntr.com)'s Model File Format program.** It is not malware.

`model.pt` is an 89-byte PyTorch/pickle file that demonstrates a **parser desync** between the static
model scanners (picklescan, ModelScan — both walk pickles with `pickletools.genops`, base-10 int parsing)
and the real C unpickler (`_pickle`, base-0 int parsing). The 6-byte `INT` opcode `I0x10\n` makes the
scanners' opcode walk abort **before** the payload, so both scanners report the file clean, while
`torch.load()` executes the payload.

**The payload is intentionally harmless:** it writes a marker file to the system temp directory
(`NOMOS_SCANNER_BYPASS`) to prove code execution. No data is exfiltrated, nothing is destroyed, there is
no network activity and no self-propagation.

## Reproduce
```
pip install picklescan==1.0.5 modelscan==0.8.8 torch
picklescan -p model.pt      # -> exit 0, PRISTINE (0 dangerous globals)
modelscan scan model.pt     # -> "No issues found"
python -c "import torch; torch.load('model.pt', weights_only=False)"   # -> marker written = code executed
```

## Responsible-disclosure notes
- Reported to huntr's model-file program (their required submission mechanism is a public HuggingFace PoC repo).
- Suggested fix for the scanner maintainers: `genops`-based walkers must fail **closed** (UNSAFE) on any parse
  abort, and align INT opcode parsing with the C unpickler (or reject non-decimal INT args).

Full write-up: see the disclosure package accompanying this PoC.