What happens when a model arrives?
A model artifact is a file, or a collection of files, used to load a machine-learning model. Weights are one part of it. Configuration, tokenizer data, templates, and sometimes executable code also shape what a loader does. The format determines how the files represent those inputs; the implementation determines how they are interpreted and checked.
This collection starts with the distinction between data containers and executable serialization, then examines SafeTensors and a practical model-download review. The research essays add parser testing, an upstream repair, and the limits of artifact signatures. Each answers a different question: what the format permits, what a particular implementation validates, or what the evidence establishes about a specific snapshot.
Choose a starting point
-
Learning model formats
Begin with the difference between a model file and a script, including the roles of GGUF, SafeTensors, and Pickle.
A Model File Is Not a Script -
Building or operating systems
Use the model-download workflow to reason about revisions, complete snapshots, loader behavior, and promotion into a running environment.
Treat a Model Download Like a Software Supply-Chain Decision -
Researching security
Explore how structure-aware parser testing produces evidence, then follow the linked ONNX example through its public reporting and repair.
Structure-Aware Fuzzing for ML Model Parsers
Read in sequence
-
Treat a Model Download Like a Software Supply-Chain Decision
Carry that distinction into a reviewable workflow.
5 min read
Take the question further
Structure-Aware Fuzzing for ML Model Parsers
Understand the method behind the parser research and the evidence needed to report a finding.
Found by AI, Fixed by AI
Follow an ONNX parser finding through its public issue and upstream fix.
When an HNSW Index Lies About Its Capacity
Walk through the CVE-2026-124959 (CERT/CC VU#681158) HNSW index deserialization heap out-of-bounds write in hnswlib and Voyager.
From Sparks to Secant: A Four-Part Series on Weight-Space Programming, C++ Kernel Safety, Subspace-Locked LoRA, and Spectral Trojan Auditing
Explore the four-part Weight-Space Programming series: Boundary-3 tensor sinks, <think> loop unsticking, Project-Then-Heal, and spectral Trojan auditing.
Signing Is Not Sealing
Examine the scope of an artifact signature and why provenance is a separate question from safety.