Hugging Face partners with Protect AI to add Guardian scanner for model security

TL;DR

Hugging Face announced a partnership with Protect AI to integrate Protect AI’s Guardian scanner into the Hub, automatically checking every public model for dangerous serialization exploits such as malicious pickle or Keras Lambda layers. This enhances model security for the entire machine‑learning community by providing frictionless, large‑scale detection of code‑execution threats.

Model‑security refresher

Hugging Face explains that model sharing involves serializing weights, configurations, and auxiliary data structures. Some serialization formats—most notably Python’s pickle—are vulnerable to arbitrary‑code‑execution attacks. Exploits have also been demonstrated in other formats, for example Keras Lambda layers that can execute malicious code. To mitigate these risks, Hugging Face previously released tools like picklescan and now incorporates Protect AI’s Guardian scanner, which detects exploits across multiple file formats. Guardian’s knowledge base is continuously updated with new signatures, extending protection beyond pickle to additional vulnerable formats.

Integration details

The partnership required embedding Guardian as a third‑party scanner within the Hub’s security pipeline. While doing so, Hugging Face revamped the Hub UI to surface scan results directly to users. New UI elements include:

  • A list view showing the status of each third‑party scan.
  • A banner indicating the overall security‑scanner status for a repository.
  • A dedicated “Pickle” button that appears when a pickle‑import scan is performed.

These components appear automatically; model authors do not need to take any action. As soon as files are pushed to a public repository, Guardian runs a scan and the results are displayed in the UI. An example repository—mcpotato/42-eicar-street—demonstrates the feature in practice.

Scale and impact

Hugging Face notes that it has already scanned hundreds of millions of files across over 1 million model repositories. Although the scanning backlog means some newly uploaded models may not be processed instantly, the automated system ensures continuous, community‑wide protection. By reducing the friction of secure model sharing, the partnership aims to foster safer AI innovation and encourage broader participation in the ecosystem.

How to get involved

Organizations or individuals interested in contributing scanning information or joining the security partnership can contact Hugging Face at security@huggingface.co. Additional documentation on Hub security is available at https://huggingface.co/docs/hub/security.

This article is based on the official Hugging Face blog post “Hugging Face Teams Up with Protect AI: Enhancing Model Security for the ML Community” published on 2024‑10‑22.

Sources