How to meet it
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Workload Sandboxing & Validation
Load only safe model file formats
Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.
OWASP AISVS v1.01, requirement 4.1.2
In plain English
Load model files only in formats that cannot run code. Some formats, such as Python pickle, run code when they are opened.
What good looks like
- Only safe formats such as safetensors or ONNX are accepted.
- Loaders reject other formats.
- Third-party models are converted before use.
How teams usually do it
- Using safetensors for weights and disabling pickle loading in your framework.
- A check in the deployment pipeline that rejects unsafe formats.
Evidence an auditor would accept
- Loader configuration and the list of allowed formats.
- A test showing a pickle file is rejected.
Common mistakes
- Loading a downloaded model with a default setting that still allows pickle.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.