Load it in a throwaway container with networking turned off, no credentials, a read-only mount for the model file and limited resources. PyTorch's security policy recommends running untrusted models in an isolated environment such as a container. With no network and nothing to steal, a malicious file has little to do.
When you need this
Sometimes you cannot avoid looking inside an unfamiliar model. A vendor sends a checkpoint. A research repo only ships an old format. A teammate found a promising fine-tune. The safe habit is to make the first load an experiment in a sealed box, not an import on a developer laptop with cloud credentials in the shell.
This is a test environment, not production. The goal is to answer one question: does this file behave as described, without side effects?
What the container must not have
| Remove | Reason |
|---|---|
| Network access | Blocks exfiltration and downloads of a second stage |
| Cloud credentials and tokens | Nothing to steal |
| Your source tree and home directory | Nothing to read or modify |
| Write access to the model file | The file cannot rewrite itself or others |
| Unlimited memory and processes | Limits abuse |
Docker's networking docs describe the none driver, where a container has only a loopback interface. The run reference also documents read-only mounts, memory limits and process limits. Check both for exact syntax for your version.
A starting recipe
docker run --rm -it \
--network none \
--read-only --tmpfs /tmp \
--cap-drop ALL --security-opt no-new-privileges=true \
--memory 16g --pids-limit 256 \
-v "$PWD/sample:/sample:ro" \
python:3.12-slim bash
Install nothing from inside; build an image beforehand that holds the loader libraries at pinned versions. Copy the model in through the read-only mount. Then run your inspection script, such as a loader that lists tensor names and shapes.
What to watch while it loads
- Does the load finish with the shapes and names the model card describes?
- Does anything try to open a network connection? With the network off, attempts show as errors. Capture them.
- Does it try to write outside temp locations?
- Does it import modules you did not expect?
Run the loader under a tool that records system calls if you have one, but the simplest signal is an error log you read after.
Know the limits of this method
A container is isolation, not a guarantee. The PyTorch text itself says to prefer a sandbox, and also says trust is not binary. A kernel or runtime bug can break out of a container, so for high-risk files use a disposable virtual machine on a host with nothing valuable on it.
Also remember that a clean first load proves little about later behavior. A model can behave normally on your test input and differently on a trigger. Treat the sandbox as protection for your machine, not as proof the model is safe to deploy.
After the test
- Delete the container and the copy of the file.
- If the file passed, convert it to a safer format inside the same sealed environment, and move only the converted file out.
- Record the result: source, hash, date, who ran it, and what you saw.
- If anything looked wrong, keep the evidence, and report it to the publisher and the hosting platform.
A separate post on this blog covers inspecting a pickle file without running it, which is the better first step when the format allows it.
Quick check
Is a virtual machine better than a container for this?
For high-risk files, usually yes, because it has a stronger boundary. A container is a reasonable default for routine checks.
Can I mount my home folder read-only to make it easier?
Avoid it. A read-only mount still lets the file read private keys and config. Mount only the sample.
Where Safeguard fits
Safeguard provides dependency scanning and policies and gates, which cover the libraries your loader code depends on. A free scan shows your repository's dependencies in a few minutes.
Sources
- PyTorch SECURITY.md, read 19 October 2026.
- Docker none network driver, read 19 October 2026.
- docker container run reference, read 19 October 2026.
Last reviewed: 19 October 2026.
