Treat a downloaded model like any third-party dependency. Confirm where it came from, check its hash or signature, prefer file formats that cannot run code on load, load it in a sandbox, record it in your inventory, and test it for your use case. OWASP lists these under LLM supply chain controls.
Why models need the same scrutiny as packages
OWASP's Data and Model Poisoning page warns that models from shared repositories can carry malware, such as malicious pickling that executes when the model is loaded. The Supply Chain page adds that models are binary black boxes, so static inspection gives limited assurance, and that model cards do not guarantee origin.
The same page cites cases including a tampered model published to spread misinformation and a fake model republished with malware after the original was removed.
The checklist
- Use verifiable sources. OWASP advises using only verifiable model sources. Prefer the publisher's official repository, and be careful with lookalike names.
- Check integrity. Compare file hashes and verify signatures where they are offered.
- Prefer safe formats. If a model ships in a format that executes code on load, treat loading it as running untrusted code. Use formats designed to hold only tensors where available.
- Load in a sandbox. No credentials, limited network, disposable environment.
- Inventory it. Record name, version, source and hash in a bill of materials. OWASP suggests SBOMs plus AI BOMs or ML SBOMs such as CycloneDX.
- Evaluate for your use. OWASP notes that models can be fine tuned to pass published benchmarks, so run your own tests and red team exercises.
- Check licences and terms. Dataset and model licences can restrict commercial use, and supplier terms may allow your data to be used for training.
What a clean scan does not prove
A passing file scan means no known bad pattern was found. It does not prove the weights are free of a backdoor. OWASP describes backdoors that stay dormant until a trigger appears, which makes them hard to find by testing.
That is why sandboxing and least privilege matter even for models you trust. If the model misbehaves, the surrounding system limits the damage.
Keep the record current
Models age. Maintained inventories let you answer a simple question when an advisory lands: do we run this, and where? OWASP also recommends a patching policy for APIs and the underlying models.
Safeguard's SBOM and dependency scanning cover the software components around your models, and the free scan at gold.safeguard.sh/scan is a quick way to see what your project pulls in.
Making it routine. One-off checks decay. Put the steps into a small internal process: a request form for new models, an automated hash and format check, a sandboxed first load, and an entry in the inventory. Block production loads from anything not in the inventory. The point is that engineers get a quick path for approved models and a clear gate for everything else.
Quick check
Is a popular model on a public hub safe by default?
No. Popularity is not provenance. Verify the publisher, the hash and the format.
Sources
Last reviewed: 19 October 2026.
