Compressed joblib files can hide malicious pickles from common model scanners

Researchers found that wrapping a scikit-learn model in joblib compression lets a malicious pickle evade several popular scanners, such as picklescan and ModelScan, which detect nothing. Pickle scanners expect the file to begin with pickle opcodes, but joblib writes compressor magic bytes first, so the scanner fails at the start and reports no issues. joblib.load still decompresses transparently and runs the embedded payload. To address this, the author added joblib_pickle_scan.py to the open-source keras-model-scan toolkit, which peels up to four decompressible layers in memory and disassembles the inner pickle without executing it. The tool flags code-execution imports and reports lz4 containers as unscannable rather than guessing. The author notes that the scanner is static analysis that flags risks but does not prove exploitability.