How Pickle Files Backdoor AI Models

[compressedgas]

Pickle can be made safe. Just limit what the unpickler can call to a fixed list based on what is expected and permitted for the pickle to use.

[vivahir215]

Nice read !

You could also use joblib format as well.

[jchandra]

joblib is not fully secure because it still relies on Pickle internally. The reason it is slightly better in pickle is due to fact that pickle file gets immediately executed when it gets imported whereas joblib doesn’t execute code just by being imported.