ModelScan
ModelScan is an open-source tool that scans machine learning models for unsafe code, protecting against model serialization attacks. It supports multiple formats including Pickle, H5, and SavedModel, and is designed for developers and security teams working with PyTorch, TensorFlow, Keras, and classic ML libraries.
✨ Key features
- Scans models for unsafe code without executing them
- Supports Pickle, H5, and SavedModel formats
- Ranks detected issues by severity (CRITICAL to LOW)
- Provides CLI and Python API for integration
- Can be integrated into CI/CD pipelines
- Generates reports in console or JSON format
🎯 Use cases
- Scan pre-trained models before loading for further training
- Scan models after training to detect supply chain attacks
- Scan models before deployment to endpoints
- Integrate model scanning into CI/CD pipelines
- Automate security checks for models in MLOps workflows
📦 Installation
🧰 Requirements: Python 3.9 to 3.12; optional extras for TensorFlow and H5 formats.
pip install modelscan
For TensorFlow or HD5 support:
pip install 'modelscan[ tensorflow, h5py ]'
🚀 Usage
modelscan -p /path/to/model_file.pkl
Or programmatically:
from modelscan.modelscan import ModelScan
from modelscan.settings import DEFAULT_SETTINGS
scanner = ModelScan(settings=DEFAULT_SETTINGS)
results = scanner.scan("/path/to/model_file.pkl")
if scanner.issues.all_issues:
print(f"Found {len(scanner.issues.all_issues)} issues!")
⚠️ Good to know
Currently supports only H5, Pickle, and SavedModel formats; more formats are planned.
❓ FAQ
How does ModelScan detect unsafe code without executing the model?
It reads the file content byte by byte, looking for code signatures that are unsafe, similar to scanning a string.
What model formats are supported?
It supports Pickle-derived formats (PyTorch, Sklearn, XGBoost), TensorFlow SavedModel, and Keras H5/Keras V3 formats.
What do the CLI exit codes mean?
Exit code 0 means no vulnerabilities found, 1 means vulnerabilities found, 2 means scan error, 3 means no supported files, and 4 means usage error.
Can I use ModelScan in my CI/CD pipeline?
Yes, it can be integrated into CI/CD pipelines to scan models before deployment.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.