Metadata-Version: 2.4
Name: weightguard
Version: 0.1.0
Summary: Multi-format security scanner for ML model artifacts (pickle/PyTorch, Keras, ONNX, GGUF, SafeTensors) with provenance and license checks.
Author: Sanjeev Jaiswal
Author-email: Sanjeev Jaiswal <jassics@gmail.com>
License-Expression: MIT
Requires-Dist: typer>=0.12
Requires-Dist: rich>=13.7
Requires-Dist: pydantic>=2.7
Requires-Dist: fickling>=0.1.12
Requires-Dist: safetensors>=0.8.0
Requires-Dist: huggingface-hub>=1.28.0
Requires-Dist: gguf>=0.19.0
Requires-Dist: h5py>=3.16.0
Requires-Dist: onnx>=1.22.0
Requires-Python: >=3.11
Project-URL: Homepage, https://github.com/jassics/weightguard
Project-URL: Repository, https://github.com/jassics/weightguard
Description-Content-Type: text/markdown

# weightguard

Security scanner for ML model artifacts. Point it at a Hugging Face repo, a git
URL, or a local path, and it flags known artifact-level risks — malicious
pickle/PyTorch payloads, Keras `Lambda`-layer code injection, ONNX custom-op
RCE surface, and anomalous/crafted GGUF headers — with a severity and a
concrete mitigation for each finding.

Model files are not inert data. Several common serialization formats can
embed code that executes the moment the file is *loaded*, before any
inference happens. `weightguard` is a static, pre-load check you run before
trusting a downloaded model.

## Install

```bash
pip install weightguard
```

## Usage

```bash
# Hugging Face repo
modelsec scan https://huggingface.co/<org>/<repo>

# git repo
modelsec scan https://github.com/<org>/<repo>.git

# local path
modelsec scan /path/to/model

# CI gate — exit non-zero only above a severity threshold (default: HIGH)
modelsec scan <target> --fail-on CRITICAL
```

Exit codes: `0` clean, `1` a finding at/above `--fail-on`, `2` target could
not be resolved.

## What it checks today

| Format | Detector | Technique |
|---|---|---|
| Pickle / PyTorch (`.pkl`, `.bin`, `.pt`, `.pth`) | Fickling AST analysis | Detects arbitrary-code-execution opcode chains; resistant to the malformed-opcode-stream evasion that defeats denylist scanners |
| SafeTensors | Format check | Flags files that fail to parse as valid SafeTensors (renamed/spoofed files) |
| Keras (`.h5`, `.keras`) | Lambda-layer check | Flags `Lambda` layers, which embed a marshalled Python function executed on load |
| ONNX | Custom-op check | Flags graphs referencing non-standard operator domains (native-code load surface) |
| GGUF | Header/KV anomaly check | Flags malformed headers, oversized KV metadata, unknown quantization types, and tensor sizes inconsistent with the file |

## Development

```bash
uv sync
uv run pytest -q
```

## License

MIT
