AIsbom inspects AI model files before they execute code

What this is about

AIsbom is an open-source security scanner for machine-learning model files. It inspects PyTorch, Pickle, Keras, GGUF, ONNX, SafeTensors, and NumPy artifacts without loading the model. That matters because some formats can contain executable behavior or references to external files. A model from a public repository is therefore not automatically as passive as an ordinary data file.

The current version 1.6.0 was released on September 14, 2026. It optionally adds VEX statements for exactly pinned Python dependencies through the public OSV API. The core job remains static inspection of model artifacts.

What AIsbom actually does

The scanner disassembles Pickle bytecode, looks for executable Lambda layers in Keras configurations, checks GGUF chat templates for suspicious Jinja constructs, and inspects ONNX references that escape the model directory. It reads SafeTensors and GGUF headers without executing the weights. According to the project documentation, no payload is loaded or run.

AIsbom accepts individual files, directories, HTTPS addresses, and hf:// references to Hugging Face. For suitable remote files it uses range requests to retrieve only required headers. Results appear in the terminal and as a software or AI bill of materials. CycloneDX and SPDX are supported, and critical findings can stop CI through a dedicated exit code. The project also provides a GitHub Action and standalone binaries for several desktop platforms.

Why it matters

Teams often treat model weights as large, passive data packages. With Pickle-based formats, that assumption is dangerous: loading can reconstruct objects and invoke functions. A GGUF model can also carry a chat template, while ONNX may reference external data paths. AIsbom runs before that loading point, making it useful as an intake gate for model registries, build pipelines, and local AI experiments.

Its second benefit is traceability. A CycloneDX or SPDX file records hashes, formats, and detected license information. That does not replace legal review, but it creates a machine-readable inventory. Version 1.6.0 can also query OSV for exactly pinned Python packages; the package name and version are sent to api.osv.dev. Users can disable that lookup.

In plain language

AIsbom works like security screening at a factory gate. A parcel is not first opened and tested on the production floor. The checkpoint examines its packaging, paperwork, and suspicious mechanisms before it enters. It cannot prove that everything inside is benign, but it can reject known dangerous constructions early.

A practical example

A small data team imports twelve models from public repositories: five SafeTensors files, three GGUF files, two ONNX models, and two older Pickle artifacts. Before the internal registry accepts them, CI scans all twelve. AIsbom reports a critical function call in one Pickle model, a path outside the model directory in one ONNX artifact, and a non-commercial license in one GGUF model.

The pipeline blocks the two technical risks. The license issue goes to the responsible reviewer, while the other nine models are recorded with hashes in a CycloneDX file. A sensible first test is small: scan one known SafeTensors model and one isolated test artifact, inspect the output, and only then make the CI gate mandatory.

Scope and limits

• Static analysis detects known structures and rules, not every possible backdoor in weights or downstream inference code.
• A clean scan does not guarantee model quality, privacy, fairness, or safe outputs. Runtime, dependencies, and application code need separate controls.
• Remote and VEX features may send metadata to Hugging Face or OSV. Teams handling confidential models must configure network access, tokens, and telemetry deliberately.
• License metadata can be absent or wrong. The generated BOM supports review but does not replace it.

SEO & GEO keywords

AIsbom, ML Model Security, AI-BOM, CycloneDX, SPDX, Pickle Security, GGUF Security, ONNX Security, SafeTensors, Hugging Face, OSV, AI supply chain