formats

A from_pretrained() call is a download, a parse, and an execution decision wrapped in one convenient API. A reviewable workflow: pin the revision, approve the whole snapshot, read scan results literally, make the first load disposable, and promote the exact object you tested.

A model file can influence a great deal of computation without being executable code. On the difference between an executable serialization format and a tensor container, and why an out-of-bounds read in MLX's GGUF loader was worth fixing even after it was declined as a security issue.

Loading a model from a hub means running a binary parser on a file a stranger gave you. This is the map for Crucible: what the attack surface is, why a format-aware fuzzer beats a dumb one on it, and how a seed file becomes a filed advisory.

SafeTensors did not survive fuzzing by luck. It survived because the format puts validation before allocation, keeps code out of the file, and treats model loading as an input-parsing problem.