---
license: apache-2.0
tags: [security-research, huntr, model-file-security, scanner-bypass, pytorch]
---
# picklescan & ModelScan bypass: LEGACY (non-zip) PyTorch .bin — 5-iteration-loop exhaustion
Benign PoC for the huntr Model File Format program. Payload writes only a nonce marker — no real harm.
## Vulnerability
The legacy torch serialization (torch.save(..., _use_new_zipfile_serialization=False)) is the format most pre-safetensors HF `pytorch_model.bin` checkpoints ship in: a flat concatenation of pickles (magic, protocol, sys_info, then the main object pickle). ModelScan's scan_pytorch calls scan_pickle_bytes(multiple_pickles=False) — it scans ONLY the protocol pickle and NEVER the main object pickle, so a plain malicious legacy .bin already evades it. picklescan's legacy branch loops `for _ in range(5): scan_pickle_bytes(...)` and RESUMES after a genops error; prepending 6 int-opcode-desync pickles (`I0x10\n`) exhausts all 5 iterations so the real main pickle falls beyond the scan window and its GLOBAL is never seen (picklescan exit 0). torch._legacy_load reads the whole stream with the C unpickler: leading junk ints are discarded and the main object's __reduce__ fires -> arbitrary code execution at load. Distinct scanner code path (flat 5-pickle loop) + distinct loader (_legacy_load) from the .pt-ZIP variant.
## Measured (2026-07-24): picklescan 1.0.5 exit 0; ModelScan 0.8.8 exit 0; torch.load fires the benign marker.
## Reproduce
```python
import torch
torch.load("pytorch_model.bin", weights_only=False)   # fires the benign marker
```