GuardModel

Block malicious AI models in your pipeline with one line of YAML.

GuardModel is a GitHub Action that automatically scans ML model files for malicious code, vulnerabilities, and security risks in CI/CD pipelines. It blocks dangerous models before they reach production by detecting pickle deserialization attacks, embedded malware, and known CVEs.

Quick Start

Add to your workflow:

name: GuardModel Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: guardmodel/scan@v1

That's it! GuardModel will scan all model files and fail the check if threats are detected.

Features

• Automatic Detection - Scans all model files on push/PR
• Multiple Formats - Supports pickle, PyTorch, Keras, ONNX, SafeTensors
• 70+ Detection Rules - Code execution, reverse shells, file system access, network activity
• GitHub Integration - SARIF output for Security tab, PR comments, JSON reports
• Configurable - Allowlists, severity thresholds, custom rules

Supported Formats

Configuration

Create .guardmodel.yml in your repository:

version: 1

# Directories to scan
include:
  - models/
  - weights/

# Directories to ignore
exclude:
  - tests/fixtures/

# Severity threshold to fail CI
fail_on: high  # critical, high, medium, low, none

# Allowlist known-safe models by SHA256
allowlist:
  - sha256: "abc123..."
    reason: "Verified by security team"

# Maximum file sizes
max_file_size: 5GB
max_total_size: 20GB

Action Inputs

Action Outputs

Threat Detection

GuardModel detects:

• Code Execution - os.system, subprocess, eval, exec
• Reverse Shells - Socket connections with shell execution
• Network Activity - HTTP requests, downloads, data exfiltration
• File System - File deletion, permission changes
• Dangerous Imports - ctypes, dynamic imports
• Obfuscation - Base64, marshal, nested pickles
• Known Malware - Hash and signature matching
• CVE Vulnerabilities - Known security issues

Example Output

PR Comment

GuardModel Security Scan

Status: FAILED - 2 threats detected

SARIF Integration

Findings appear in the GitHub Security tab with:

• Rule descriptions
• File locations
• Remediation guidance

Development

# Install dependencies
npm install
pip install -r requirements.txt

# Build
npm run build

# Test
npm test
pytest tests/

# Package for release
npm run package

Architecture

guardmodel/
├── action.yml              # GitHub Action definition
├── src/                    # TypeScript source
│   ├── index.ts           # Entry point
│   ├── orchestrator.ts    # Scan coordination
│   ├── config.ts          # Configuration
│   ├── walker.ts          # File discovery
│   └── reporters/         # Output formatters
├── python/
│   ├── agents/            # Scanner agents
│   │   ├── pickle_agent.py
│   │   ├── keras_agent.py
│   │   ├── onnx_agent.py
│   │   └── safetensors_agent.py
│   └── rules/             # Detection rules
└── tests/                 # Test suite

Security

GuardModel:

• Scans locally - no files uploaded to external servers
• No telemetry without opt-in
• Runs in isolated GitHub runner environment
• Dependencies pinned with hash verification

License

MIT

Contributing

Contributions welcome! Please see CONTRIBUTING.md.

Links

• Documentation
• Rule Reference
• GitHub Marketplace