AI Model Security Training Must Address Checkpoint Deserialization Risks

Most AI security training focuses on prompt injection and jailbreaks but overlooks a more fundamental threat: malicious code hidden inside model checkpoint files. PyTorch's .pt and .bin files contain Python pickle archives that execute arbitrary code when loaded, a vulnerability class known as CWE-502 deserialization of untrusted data. CVE-2025-24357 demonstrated this risk in vLLM, where checkpoints downloaded from a model hub were loaded without the weights_only=True safeguard, enabling remote code execution on the inference host. A parallel flaw, CVE-2024-11393, affected Hugging Face Transformers with a CVSS score of 8.8, reached through MaskFormer model file parsing. Security teams are advised to inspect checkpoint files using tools like pickletools and fickling, adopt safer formats such as safetensors, and mirror approved models into internal registries pinned by digest rather than pulling directly from public hubs.