Downloading an open-weights model checkpoint from Hugging Face is an import of executable architecture, serialization containers, and chat templates, not an import of passive numerical arrays. A model repository containing PyTorch pickle weights (.bin
, .pt
, .pkl
) allows an adversary to execute arbitrary system commands during deserialization through Python __reduce__
opcode execution. A repository containing custom Python code (modeling_*.py
, configuration_*.py
) executes arbitrary Python runtime logic whenever a consumer sets trust_remote_code=True
in standard loader harnesses. In this technical evaluation, I audit the security profile of kapitsaprime/Clover-35B-A3B-Preview-MLX-4bit against its upstream unquantized base model Diffuspace/Clover-35B-A3B-Preview. This guide can apply to any models. I provide concrete attack and vulnerability code examples demonstrating how adversaries exploit unpickling, auto-mapping, and template evaluation. I verify the removal of untrusted execution hooks in the quantized release, deploy the 20.6 GB checkpoint to an Apple Silicon Mac mini M4 Pro with 64 GB unified memory, record its empirical decoding throughput, and implement a pre-execution tool-call inspection harness that strips Personally Identifiable Information (PII) before any model-generated function invocation executes.
Investigation Roadmap & Structural Stakes
Deserialization Architecture and Pickle Elimination: Verifying the absence of Python pickle payloads and confirming pure safetensors
memory-mapping to eliminate arbitrary bytecode execution during model loading.
Custom Runtime Code Elimination: Auditing config.json
to verify the removal of auto_map
directives, ensuring the model loads without trust_remote_code=True
.
Chat Template Static Analysis: Inspecting chat_template.jinja
to verify that Jinja2 environment rendering does not expose Server-Side Template Injection (SSTI) or unauthorized Python object traversal.
Cryptographic Proof of Conversion: Validating conversion.json
SHA-256 hashes directly against Git LFS commit tree OIDs before downloading model weight shards.
Zero-Trust Local Execution on Apple Silicon: Orchestrating unified memory allocation, terminating resident background model services to claim 37 GB of memory headroom, and deploying via native Metal inference.
Pre-Tool-Call PII Sanitization Harness: Building a production-grade interceptor harness that validates XML tool-call schemas and scrubs PII from parameter strings prior to system execution.
Read more
