invoke-ai/InvokeAI · critical · RuntimeError

Error scanning the model at {path.stem} for malware. Abortin

Error message

Error scanning the model at {path.stem} for malware. Aborting import.

What it means

When picklescan itself fails to scan a pickle-based checkpoint (scan_result.scan_err is truthy — corrupt pickle, scanner crash, unsupported opcodes), ModelOnDisk.load_state_dict raises this RuntimeError rather than loading an unscannable file, unless unsafe_disable_picklescan is enabled. An unscannable pickle is treated as untrusted.

Source

Thrown at invokeai/backend/model_manager/model_on_disk.py:137

                scan_result = scan_file_path(path)
                if scan_result.infected_files != 0:
                    if get_config().unsafe_disable_picklescan:
                        logger.warning(
                            f"The model {path.stem} is potentially infected by malware, but picklescan is disabled. "
                            "Proceeding with caution."
                        )
                    else:
                        raise RuntimeError(
                            f"The model {path.stem} is potentially infected by malware. Aborting import."
                        )
                if scan_result.scan_err:
                    if get_config().unsafe_disable_picklescan:
                        logger.warning(
                            f"Error scanning the model at {path.stem} for malware, but picklescan is disabled. "
                            "Proceeding with caution."
                        )
                    else:
                        raise RuntimeError(f"Error scanning the model at {path.stem} for malware. Aborting import.")
                checkpoint = torch.load(path, map_location="cpu")
                assert isinstance(checkpoint, dict)
            elif path.suffix.endswith(".gguf"):
                checkpoint = gguf_sd_loader(path, compute_dtype=torch.float32)
            elif path.suffix.endswith(".safetensors"):
                if _is_sdnq_safetensors(path):
                    checkpoint = sdnq_sd_loader(path, compute_dtype=torch.float32)
                else:
                    checkpoint = safetensors.torch.load_file(path)
            else:
                raise ValueError(f"Unrecognized model extension: {path.suffix}")

        state_dict = checkpoint.get("state_dict", checkpoint)

        # Normalize PEFT named-adapter keys (e.g. `lora_A.default.weight` → `lora_A.weight`).
        # Pattern is LoRA-specific, so this is a no-op for non-LoRA state dicts.
        from invokeai.backend.patches.lora_conversions.peft_adapter_utils import normalize_peft_adapter_names

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Re-download the checkpoint; verify its size/hash matches the published value (corruption is the most common cause).
2. Run picklescan directly on the file to see the underlying scan error and confirm whether the file is truly malformed.
3. Load/convert the file in a sandbox (fresh venv, no network) to inspect it; re-save as safetensors and import that.
4. Only if you accept the risk, set unsafe_disable_picklescan=true in invokeai.yaml and retry.

Example fix

// before
$ md5sum model.ckpt  # never checked
# import fails: scan_err
// after
$ curl -sL <url> -o model.ckpt && sha256sum model.ckpt   # compare to published hash
$ picklescan --path model.ckpt
# re-import once hash matches and scan passes

import hashlib
def verify_download(path, expected_sha256: str) -> bool:
    h = hashlib.sha256()
    with open(path, 'rb') as f:
        for chunk in iter(lambda: f.read(1 << 20), b''):
            h.update(chunk)
    return h.hexdigest() == expected_sha256

try:
    sd = model_on_disk.load_state_dict(path)
except RuntimeError as e:
    if 'Error scanning the model' in str(e):
        logger.error(f'{path} is unscannable/corrupt; re-download and verify its hash.')
    raise

When it happens

Trigger: torch-serialization paths (.pt/.pth/.ckpt/.bin) where picklescan.scan_result.scan_err is set: truncated/corrupt downloads, exotic or very new pickle opcodes, non-torch pickles renamed to .ckpt, zip archives picklescan can't parse.

Common situations: Interrupted downloads leaving partial files; checkpoints saved by unusual/very new or very old torch versions; files renamed from other formats to .ckpt; encrypted or DRM-wrapped community models.

Related errors

• The model {path.stem} is potentially infected by malware. Ab
• The model at {checkpoint} is potentially infected by malware
• Error scanning model at {checkpoint} for malware. Aborting l
• This model can not be loaded. If you're looking for help, co
• Cannot split QKV tensor '{key}': first dimension ({tensor.sh

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/18489f906c2ddfd2. Report an issue: GitHub.