hawkes.aiKey ideas
- The one idea — Loading a pickle checkpoint can execute arbitrary code — model files were attack vectors, and safetensors exists because of it.
- How it is shown — A .pt crate unpacking into executing machinery vs the inert safetensors crate; a hub scanning crates like airport security.
- The trap to avoid — Treating model files as media — a stranger's .pt deserves the caution of a stranger's .exe.
- What it sets up — AI's stranger attacks (words that hack the model).
You download an AI model file, you load it — and it can execute any code its author hid inside. For years, that was the standard format.
The one idea
Loading a pickle checkpoint can execute arbitrary code — model files were attack vectors, and safetensors exists because of it.
For years, downloading an AI model meant running a stranger's code. Not a bug — the file format working as designed. The pickle problem: why "safe" is in safetensors, and your first taste of AI's security story. Episode one hundred: safetensors is data with no verbs. Pickle — Python's old everything-saver, heart of classic checkpoints — is the opposite: a command tape the loader obeys to rebuild saved objects. The command set includes "call any function." Loading isn't reading — it's obeying. The format has verbs, and verbs can be weapons. The attack writes itself: a file dressed as a legitimate model, carrying one extra instruction. The payload runs during the load — before a single token generates — and the model then works perfectly, because the best disguise is a working brain. Not hypothetical: researchers have repeatedly found malicious model files on public hubs. How was this ever allowed?
How it works — the demo
A .pt crate unpacking into executing machinery vs the inert safetensors crate; a hub scanning crates like airport security.
No villain — a village. Pickle was research convenience — save anything, instantly — perfect for labs where everyone knew everyone. Then the village became a metropolis: millions of strangers exchanging model files on infrastructure inherited from the trusting era. Convenience shipped; security debt accrued. File the pattern — this industry repeats it. The immune response came in layers. A format that can't carry instructions — the whole reason safetensors exists. Hubs scanning uploads for malicious pickles. And the loader reformed: modern PyTorch defaults to weights-only loading, refusing the dangerous kind unless you insist. Direction of travel: inert by default, verbs by exception. The trap is a category error: filing model files with media — things that play but can't act.
The trap to avoid
Treating model files as media — a stranger's .pt deserves the caution of a stranger's .exe.
Why it matters — and what’s next
AI's stranger attacks (words that hack the model).
Wrong shelf. A pickle checkpoint belongs with executables: things that do. The rule: prefer safetensors — anything reputable offers it. A stranger's pickle gets executable-grade suspicion, whatever livery it wears. The unsettling coda: this was the old-fashioned attack — ordinary malware in an extraordinary box, beaten by ordinary hygiene. AI's unique attacks are stranger: no code at all, just words — sentences that reprogram the reader mid-read. That's act nine — worth the wait. First, the trilogy's finale: the format that made local AI a double-click. Next: GGUF.
This is one short episode in AI: Zero → Frontier, a step-by-step climb through how AI actually works. Each episode builds only on the ones before it.
Full transcript 2:30 of narration
For years, downloading an AI model meant running a stranger's code. Not a bug — the file format working as designed. The pickle problem: why "safe" is in safetensors, and your first taste of AI's security story.
Episode one hundred: safetensors is data with no verbs. Pickle — Python's old everything-saver, heart of classic checkpoints — is the opposite: a command tape the loader obeys to rebuild saved objects. The command set includes "call any function." Loading isn't reading — it's obeying. The format has verbs, and verbs can be weapons.
The attack writes itself: a file dressed as a legitimate model, carrying one extra instruction. The payload runs during the load — before a single token generates — and the model then works perfectly, because the best disguise is a working brain. Not hypothetical: researchers have repeatedly found malicious model files on public hubs.
How was this ever allowed? No villain — a village. Pickle was research convenience — save anything, instantly — perfect for labs where everyone knew everyone. Then the village became a metropolis: millions of strangers exchanging model files on infrastructure inherited from the trusting era. Convenience shipped; security debt accrued. File the pattern — this industry repeats it.
The immune response came in layers. A format that can't carry instructions — the whole reason safetensors exists. Hubs scanning uploads for malicious pickles. And the loader reformed: modern PyTorch defaults to weights-only loading, refusing the dangerous kind unless you insist. Direction of travel: inert by default, verbs by exception.
The trap is a category error: filing model files with media — things that play but can't act. Wrong shelf. A pickle checkpoint belongs with executables: things that do. The rule: prefer safetensors — anything reputable offers it. A stranger's pickle gets executable-grade suspicion, whatever livery it wears.
The unsettling coda: this was the old-fashioned attack — ordinary malware in an extraordinary box, beaten by ordinary hygiene. AI's unique attacks are stranger: no code at all, just words — sentences that reprogram the reader mid-read. That's act nine — worth the wait. First, the trilogy's finale: the format that made local AI a double-click. Next: GGUF.