- A clean model-file scan is evidence about scanner findings, not proof of side-effect-free loading. In our synthetic Crucible demo, PickleScan did not flag a pickle artifact whose load attempted to open a SQLite database.
- The configured CPython audit hook recorded and blocked that attempt; the gate returned QUARANTINE. This is evidence about that load and selected Python events, not OS isolation or a guarantee that every unsafe effect is blocked.
- A second synthetic fixture exposes the other gap: static analysis found builtins.eval, but its conditional branch did not run. The gate returned REVIEW. A quiet observed load did not settle the suspicious static finding; further evidence was still needed.
- For model admission, ask what was checked, what the load attempted and what remains unresolved. Keep those findings separate from a clean-scan badge. See the breakdown: https://veriprajna.com/demos/ai-supply-chain-security #AISecurity #SupplyChainSecurity #MLSecOps
Published on X · October 12, 2026
On social media
See this post on its original platform
In our archive