invoke-ai/InvokeAI · critical · Exception

The model at {checkpoint} is potentially infected by malware

Error message

The model at {checkpoint} is potentially infected by malware. Aborting load.

What it means

torch_load_file runs the picklescan malware scanner on .pt/.ckpt checkpoints before torch.load. When picklescan reports a positive infection and the unsafe_disable_picklescan config flag is false, loading is aborted with this generic Exception to prevent arbitrary code execution embedded in the pickle payload.

Source

Thrown at invokeai/app/services/model_load/model_load_default.py:127

    ) -> LoadedModelWithoutConfig:
        # Resolve the calling thread's cache once so the whole load uses a single device's cache.
        ram_cache = self.ram_cache
        cache_key = str(model_path)
        try:
            return LoadedModelWithoutConfig(cache_record=ram_cache.get(key=cache_key), cache=ram_cache)
        except IndexError:
            pass

        def torch_load_file(checkpoint: Path) -> AnyModel:
            scan_result = scan_file_path(checkpoint)
            if scan_result.infected_files != 0:
                if self._app_config.unsafe_disable_picklescan:
                    self._logger.warning(
                        f"Model at {checkpoint} is potentially infected by malware, but picklescan is disabled. "
                        "Proceeding with caution."
                    )
                else:
                    raise Exception(f"The model at {checkpoint} is potentially infected by malware. Aborting load.")
            if scan_result.scan_err:
                if self._app_config.unsafe_disable_picklescan:
                    self._logger.warning(
                        f"Error scanning model at {checkpoint} for malware, but picklescan is disabled. "
                        "Proceeding with caution."
                    )
                else:
                    raise Exception(f"Error scanning model at {checkpoint} for malware. Aborting load.")

            result = torch_load(checkpoint, map_location="cpu")
            return result

        def diffusers_load_directory(directory: Path) -> AnyModel:
            load_class = GenericDiffusersLoader(
                app_config=self._app_config,
                logger=self._logger,
                ram_cache=ram_cache,
                convert_cache=self.convert_cache,

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Verify the model's provenance; prefer safetensors versions of the model.
2. Re-download the file — the artifact may be corrupted or tampered.
3. Scan manually with picklescan CLI and inspect flagged opcodes.
4. Only if you fully trust the source, set unsafe_disable_picklescan=true in config (not recommended).

Example fix

// before
# config invoking default scan on an untrusted .ckpt
load({ path: 'suspicious_model.ckpt' });
// after
# use a safetensors export or a vetted mirror
load({ path: 'model.safetensors' }); // safetensors cannot embed pickle payloads

from picklescan import scan_file_path
result = scan_file_path(checkpoint)
if result.infected_files > 0:
    # refuse or use safetensors alternative
    ...

try:
    model = loader.load_model(path)
except Exception as e:
    if 'potentially infected by malware' in str(e):
        quarantine(path)
        log.warning('Malware-flagged model rejected: %s', path)
    else:
        raise

When it happens

Trigger: Loading a checkpoint where picklescan flags dangerous global imports (e.g. torchpickle codecs, os.system in pickle opcodes) via torchckpt/safetensors load paths that route through torch_load_file.

Common situations: Downloading models from untrusted sources (random HF repos, shady mirrors); old .ckpt files from pre-safetensors era; a false positive from picklescan on benign pickle globals; users who intentionally disabled the scan seeing no error but others hitting the raise.

Related errors

• The model {path.stem} is potentially infected by malware. Ab
• Error scanning model at {checkpoint} for malware. Aborting l
• Error scanning the model at {path.stem} for malware. Abortin
• only relative download paths accepted
• Cannot derive a safe filename for {url} from '{file_name}'

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/81f95746cc9b8454. Report an issue: GitHub.