{"record":{"id":"81f95746cc9b8454","repo":"invoke-ai/InvokeAI","slug":"the-model-at-checkpoint-is-potentially-infected","errorCode":null,"errorMessage":"The model at {checkpoint} is potentially infected by malware. Aborting load.","messagePattern":"The model at (.+?) is potentially infected by malware\\. Aborting load\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"critical","filePath":"invokeai/app/services/model_load/model_load_default.py","lineNumber":127,"sourceCode":"    ) -> LoadedModelWithoutConfig:\n        # Resolve the calling thread's cache once so the whole load uses a single device's cache.\n        ram_cache = self.ram_cache\n        cache_key = str(model_path)\n        try:\n            return LoadedModelWithoutConfig(cache_record=ram_cache.get(key=cache_key), cache=ram_cache)\n        except IndexError:\n            pass\n\n        def torch_load_file(checkpoint: Path) -> AnyModel:\n            scan_result = scan_file_path(checkpoint)\n            if scan_result.infected_files != 0:\n                if self._app_config.unsafe_disable_picklescan:\n                    self._logger.warning(\n                        f\"Model at {checkpoint} is potentially infected by malware, but picklescan is disabled. \"\n                        \"Proceeding with caution.\"\n                    )\n                else:\n                    raise Exception(f\"The model at {checkpoint} is potentially infected by malware. Aborting load.\")\n            if scan_result.scan_err:\n                if self._app_config.unsafe_disable_picklescan:\n                    self._logger.warning(\n                        f\"Error scanning model at {checkpoint} for malware, but picklescan is disabled. \"\n                        \"Proceeding with caution.\"\n                    )\n                else:\n                    raise Exception(f\"Error scanning model at {checkpoint} for malware. Aborting load.\")\n\n            result = torch_load(checkpoint, map_location=\"cpu\")\n            return result\n\n        def diffusers_load_directory(directory: Path) -> AnyModel:\n            load_class = GenericDiffusersLoader(\n                app_config=self._app_config,\n                logger=self._logger,\n                ram_cache=ram_cache,\n                convert_cache=self.convert_cache,","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/services/model_load/model_load_default.py#L109-L145","documentation":"torch_load_file runs the picklescan malware scanner on .pt/.ckpt checkpoints before torch.load. When picklescan reports a positive infection and the unsafe_disable_picklescan config flag is false, loading is aborted with this generic Exception to prevent arbitrary code execution embedded in the pickle payload.","triggerScenarios":"Loading a checkpoint where picklescan flags dangerous global imports (e.g. torchpickle codecs, os.system in pickle opcodes) via torchckpt/safetensors load paths that route through torch_load_file.","commonSituations":"Downloading models from untrusted sources (random HF repos, shady mirrors); old .ckpt files from pre-safetensors era; a false positive from picklescan on benign pickle globals; users who intentionally disabled the scan seeing no error but others hitting the raise.","solutions":["Verify the model's provenance; prefer safetensors versions of the model.","Re-download the file — the artifact may be corrupted or tampered.","Scan manually with picklescan CLI and inspect flagged opcodes.","Only if you fully trust the source, set unsafe_disable_picklescan=true in config (not recommended)."],"exampleFix":"// before\n# config invoking default scan on an untrusted .ckpt\nload({ path: 'suspicious_model.ckpt' });\n// after\n# use a safetensors export or a vetted mirror\nload({ path: 'model.safetensors' }); // safetensors cannot embed pickle payloads","handlingStrategy":"try-catch","validationCode":"from picklescan import scan_file_path\nresult = scan_file_path(checkpoint)\nif result.infected_files > 0:\n    # refuse or use safetensors alternative\n    ...","typeGuard":null,"tryCatchPattern":"try:\n    model = loader.load_model(path)\nexcept Exception as e:\n    if 'potentially infected by malware' in str(e):\n        quarantine(path)\n        log.warning('Malware-flagged model rejected: %s', path)\n    else:\n        raise","preventionTips":["Prefer .safetensors files, which cannot carry pickle payloads","Download only from vetted repos/publishers","Keep picklescan updated","Never disable scanning (unsafe_disable_picklescan) in shared environments"],"tags":["security","malware","picklescan","model-load"],"backgroundTag":"malware-scan-failed","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}