ClamAV false positive on the adapter safetensors
The three .safetensors files under adapters/ are currently labelled Unsafe. The flag comes from the ClamAV pass rather than the model scanner, which has not reported yet:
"avScan": {"status": "unsafe", "message": "Hugging Face ClamAV detected 1 infection(s)", "version": "1.5.4/28091"}
"protectAiScan": {"status": "queued"}
We believe this is a false positive, and would be grateful for a rescan or a signature review.
The files are fully accounted for structurally
Parsing the safetensors header of adapters/h3_hero_step12000.safetensors:
| file size | 1,880,934,304 |
8 + header length + tensor data |
1,880,934,304 |
| trailing bytes | 0 |
| gaps between tensor regions | 0 |
| tensors | 400, all F32 |
Every byte in the file is accounted for by the 8-byte length prefix, the JSON header, and contiguous tensor data. There is no unaccounted region in which a payload could sit, and the format carries no execution path.
The detections are distributed like signature collisions
The same weights are mirrored across three sibling repos, all produced by one training pipeline and one conversion script:
| repo | unsafe | safe |
|---|---|---|
alvdansen/h3-hero-checkpoints |
5 | 3 |
alvdansen/h3-tween-checkpoints |
12 | 2 |
alvdansen/h3-seq-checkpoints |
19 | 2 |
Identical provenance, identical format, identical converter — yet some files are flagged and others cleared. That pattern is what a signature matching by chance inside ~1.9 GB of float32 tensor data looks like, rather than a real infection, which would not distribute at random across one pipeline's output.
Happy to supply the full header dump, the conversion script, or anything else useful. Thank you.
No good deed goes unpunished by false AV positives, a timeless classic :- )