---
license: apache-2.0
tags:
- modelscan
- pytorch
- security
---

# ModelScan legacy PyTorch multi-pickle scanner mismatch

This repository contains a benign, non-executing regression artifact for a ModelScan scanner mismatch in legacy PyTorch `.pt` files.

`legacy_marker.pt` follows the legacy PyTorch stream shape:

1. PyTorch magic number pickle
2. protocol-version pickle
3. sys-info pickle
4. object pickle
5. storage-key-list pickle

The object pickle contains a harmless reference to `sys.getsizeof`. It does not contain a command execution payload and should not perform side effects when inspected. ModelScan's default unsafe-global policy marks `sys:*` as CRITICAL, but `scan_pytorch()` calls `scan_pickle_bytes(..., multiple_pickles=False)`, so only the first magic-number pickle is inspected.

## Local verification

Tested against `protectai/modelscan` tag `v0.8.8`, commit `61fcec9c2a37c24c1fb12d84ede30fe248a364bd`.

```text
ModelScan scan(path) issues: 0
ModelScan scan(path) errors: 0
ModelScan scanned: ['legacy_marker.pt']
Full multi-pickle scan issues: [('sys', 'getsizeof', 'CRITICAL')]
```

Artifact SHA-256:

```text
c49a1db639e12cd375462eb2f377596513c40f5c440d901e62aa5dbf04622660  legacy_marker.pt
```

## Relevant source behavior

PyTorch's legacy serializer writes multiple pickles before and after the object pickle. In current PyTorch source, `_legacy_save()` writes the magic number, protocol version, sys-info, then `pickler.dump(obj)`, followed by serialized storage keys. `_legacy_load()` reads those fields in the same order and deserializes the object pickle after the sys-info record.

ModelScan's `scan_pytorch()` accepts the PyTorch magic number, then calls the pickle scanner with `multiple_pickles=False`, which stops after the first pickle and does not inspect the object pickle.

## Expected result

ModelScan should inspect all pickle records that are part of the legacy PyTorch stream, or at minimum continue through the object pickle after validating the magic number and protocol metadata.