Skip to main content
AI Supply Chain Security findings include detections and advisories. Each finding is described by a category, a threat level, and a threat type. These answer different questions: what was found, how severe it is, and how the finding is classified. Policy evaluation separately determines whether a scan is compliant.
Threat-classification availability depends on the scanner build and deployment. See Scan Report for enablement and compatibility details.

​
Threat levels

Findings can have a Critical, High, Medium, or Low threat level. Threat level belongs to the individual rule, not the category as a whole. The table lists the exact values used by active rules; a list is not a continuous range. For example, Embedded Payloads has Low and Critical findings, not every threat level between them.

​
Threat types

Threat type is independent of threat level. A suspicious finding can be Critical. A category can contain more than one threat type, so categories are not divided into detection-only and advisory-only lists. Detections and advisories are the report’s finding collections; threat type does not determine which collection contains a finding, and an advisory can carry a threat level. See Scan Report for collection placement, counts, legacy unclassified findings, and scan-level summaries.

​
Categories

​
Category details

​
Arbitrary Code Execution

Model content can invoke code or exploit a loader or template renderer. Findings include executable functions, embedded PyTorch in Keras, and XML external entities in PMML. Review the evidence: suspicious code capability does not by itself establish malicious intent.

​
Arbitrary Read Access

Keras/HDF5 external storage references or external links can cause a reader to access host files, including paths outside the model directory.

​
Decompression Vulnerabilities

Compressed content can expand disproportionately or exhaust resources during extraction. Archive path traversal is covered by Directory Traversal.

​
Denial of Service

Functions, XML content, or model structures can terminate processing or demand excessive memory, computation, or traversal. Some findings identify a reader resource limit rather than a confirmed attack.

​
Directory Traversal

Model references or archive entries can access paths outside the expected directory. Includes ONNX external-data paths and TAR/ZIP Slip attacks that can overwrite host files.

​
Embedded Credentials

Model-associated JSON contains a credential-shaped string or a high-entropy value in a secret-like field. Matches are not validated with the issuing service; review and rotate exposed credentials.

​
Embedded Payloads

File content includes executable signatures, test-malware patterns, or other possible payloads. A pattern match requires investigation and does not establish that the payload will execute.

​
Graph Payload

Computational graph patterns can indicate hidden behavior or a neural backdoor. Findings include heuristic graph patterns and control-vector-related behavior; review model provenance and intended behavior.

​
Model Reference

A container references external model artifacts or requires model selection at runtime. Referenced artifacts are not scanned automatically; download and scan them separately.

​
Model Tampering

Model files differ from a signature manifest, the signature cannot be validated, or files are outside signature coverage. An invalid signature can also result from the wrong verification key.

​
Network Requests

Functions or libraries can make outbound requests, enabling data exfiltration, payload downloads, or communications with an attacker.

​
Out of Bounds Memory Read Access

Tensor metadata or payload lengths can cause a vulnerable reader to access memory outside the intended buffer, potentially disclosing adjacent memory.

​
Out of Bounds Memory Write Access

Tensor data contains more elements than its declared dimensions allow. A vulnerable reader can copy attacker-controlled data beyond the destination buffer.

​
Repository Sideloading

Configuration JSON uses auto_map to load additional classes. References may resolve to code outside the model repository and require review before use.

​
Suspicious File Format

Unexpected structures, protocol mismatches, missing graphs, or inspection limits require review. Findings can identify malformed content, incomplete analysis, or format features that need attention.

​
Suspicious Functions

Functions can execute code or return callable objects. Their presence warrants review of how they are used and combined.

​
Tokenizer Tampering

Duplicate token IDs, unsafe orphan tokens, or discrepancies in tokenizer artifacts can alter how text is encoded or decoded.

​
Tokenizer Vulnerabilities

BPE and WordPiece tokenization strategies can be susceptible to TokenBreak, allowing manipulated inputs to change model classifications. Format coverage depends on the rule and scanner version. Category descriptions identify representative inputs, not a guarantee that every supported format is checked for every category. See Supported model formats for scanner format support. TokenBreak is documented under Tokenizer Vulnerabilities. Control-vector findings are included in Graph Payload; see Control Vector remediation for technique-specific guidance. Model Sideloading is not an active category in this release; its historical remediation guidance remains available for older results.

​
Further reading