{"record":{"id":"18489f906c2ddfd2","repo":"invoke-ai/InvokeAI","slug":"error-scanning-the-model-at-path-stem-for-malwar","errorCode":null,"errorMessage":"Error scanning the model at {path.stem} for malware. Aborting import.","messagePattern":"Error scanning the model at (.+?) for malware\\. Aborting import\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"invokeai/backend/model_manager/model_on_disk.py","lineNumber":137,"sourceCode":"                scan_result = scan_file_path(path)\n                if scan_result.infected_files != 0:\n                    if get_config().unsafe_disable_picklescan:\n                        logger.warning(\n                            f\"The model {path.stem} is potentially infected by malware, but picklescan is disabled. \"\n                            \"Proceeding with caution.\"\n                        )\n                    else:\n                        raise RuntimeError(\n                            f\"The model {path.stem} is potentially infected by malware. Aborting import.\"\n                        )\n                if scan_result.scan_err:\n                    if get_config().unsafe_disable_picklescan:\n                        logger.warning(\n                            f\"Error scanning the model at {path.stem} for malware, but picklescan is disabled. \"\n                            \"Proceeding with caution.\"\n                        )\n                    else:\n                        raise RuntimeError(f\"Error scanning the model at {path.stem} for malware. Aborting import.\")\n                checkpoint = torch.load(path, map_location=\"cpu\")\n                assert isinstance(checkpoint, dict)\n            elif path.suffix.endswith(\".gguf\"):\n                checkpoint = gguf_sd_loader(path, compute_dtype=torch.float32)\n            elif path.suffix.endswith(\".safetensors\"):\n                if _is_sdnq_safetensors(path):\n                    checkpoint = sdnq_sd_loader(path, compute_dtype=torch.float32)\n                else:\n                    checkpoint = safetensors.torch.load_file(path)\n            else:\n                raise ValueError(f\"Unrecognized model extension: {path.suffix}\")\n\n        state_dict = checkpoint.get(\"state_dict\", checkpoint)\n\n        # Normalize PEFT named-adapter keys (e.g. `lora_A.default.weight` → `lora_A.weight`).\n        # Pattern is LoRA-specific, so this is a no-op for non-LoRA state dicts.\n        from invokeai.backend.patches.lora_conversions.peft_adapter_utils import normalize_peft_adapter_names\n","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/backend/model_manager/model_on_disk.py#L119-L155","documentation":"When picklescan itself fails to scan a pickle-based checkpoint (scan_result.scan_err is truthy — corrupt pickle, scanner crash, unsupported opcodes), ModelOnDisk.load_state_dict raises this RuntimeError rather than loading an unscannable file, unless unsafe_disable_picklescan is enabled. An unscannable pickle is treated as untrusted.","triggerScenarios":"torch-serialization paths (.pt/.pth/.ckpt/.bin) where picklescan.scan_result.scan_err is set: truncated/corrupt downloads, exotic or very new pickle opcodes, non-torch pickles renamed to .ckpt, zip archives picklescan can't parse.","commonSituations":"Interrupted downloads leaving partial files; checkpoints saved by unusual/very new or very old torch versions; files renamed from other formats to .ckpt; encrypted or DRM-wrapped community models.","solutions":["Re-download the checkpoint; verify its size/hash matches the published value (corruption is the most common cause).","Run picklescan directly on the file to see the underlying scan error and confirm whether the file is truly malformed.","Load/convert the file in a sandbox (fresh venv, no network) to inspect it; re-save as safetensors and import that.","Only if you accept the risk, set unsafe_disable_picklescan=true in invokeai.yaml and retry."],"exampleFix":"// before\n$ md5sum model.ckpt  # never checked\n# import fails: scan_err\n// after\n$ curl -sL <url> -o model.ckpt && sha256sum model.ckpt   # compare to published hash\n$ picklescan --path model.ckpt\n# re-import once hash matches and scan passes","handlingStrategy":"validation","validationCode":"import hashlib\ndef verify_download(path, expected_sha256: str) -> bool:\n    h = hashlib.sha256()\n    with open(path, 'rb') as f:\n        for chunk in iter(lambda: f.read(1 << 20), b''):\n            h.update(chunk)\n    return h.hexdigest() == expected_sha256","typeGuard":null,"tryCatchPattern":"try:\n    sd = model_on_disk.load_state_dict(path)\nexcept RuntimeError as e:\n    if 'Error scanning the model' in str(e):\n        logger.error(f'{path} is unscannable/corrupt; re-download and verify its hash.')\n    raise","preventionTips":["Verify checkpoint hashes/sizes against published values after download","Re-download files that failed mid-transfer instead of retrying the import","Run `picklescan --path <file>` standalone to see the underlying scan error","Keep torch/picklescan versions current so new pickle formats remain scannable"],"tags":["security","picklescan","corrupt-file","pickle","model-loading"],"backgroundTag":"pickle-scan-failed","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}