Many model files are archives. A PyTorch checkpoint or TorchScript export is a zip, a Keras v3 .keras file is a zip, a NumPy .npz is a zip, a NeMo .nemo file is a tar, and model hubs are full of .zip and .tar.gz bundles. Weights never need native code or scripts, so any program inside one of these archives deserves a look before the archive is trusted.

Why pickle scanners do not see it

Most model-file scanners look at the pickle inside a checkpoint, or at config files that name a class to import. A shared library stored as model.bin , an ELF binary next to the weights, or a shell script in a subfolder is neither, so those checks pass over it. It does not run by itself.…