kolbrian

/

qgate-checkpoints

like 0

The file

checkpoints/canon/out-openwebtext_phase15_w2000_qa_normed_qonly/ckpt.pt
SHA256 a604298e1f8e3476ba2be557c528bfa59e9d2adc4cde5ae90483f34282b7b016

is marked Unsafe on the strength of a single ClamAV detection ("Hugging Face ClamAV detected 1 infection(s)"). The other scanners on the same file report:

• HF Picklescan — not a pickle (no unsafe pickle opcodes)
• VirusTotal — not available
• JFrog / Protect AI — queued

I re-scanned the identical file (hash verified against the one shown in the repo UI) with a current ClamAV build and a freshly updated signature database:

Known viruses: 3,628,002        Engine version: 1.5.3
Scanned files: 1                Infected files: 0
Data scanned: 2.68 GiB          Data read: 1.39 GiB (ratio 1.93:1)

Zero detections. The 1.93:1 read-to-scan ratio confirms the zip container was decompressed and its contents scanned, not just the wrapper.

Why I believe this is a false positive rather than a retired-but-real detection:

1. The file is a torch.save checkpoint — 1.49 GB of fp32 tensor storage, i.e. roughly 1.5e9 bytes of high-entropy numeric data. Byte-signature collisions in weight files are a known false-positive class.
2. Picklescan, which targets the actual threat model for .pt files, reports nothing.
3. The file is byte-identical in size (1,489,063,333) to its sibling out-openwebtext_phase15_w2000_qa_normed_yonly/ckpt.pt, produced by the same training script in the same batch, which is not flagged. One flagged file out of 33 with identical provenance is the signature of a random collision.
4. All 33 checkpoints in this repo were produced locally by nanoGPT-derived training code; none were downloaded or third-party.

Could this file be re-scanned against current signatures? Happy to provide anything else useful.

Thanks.