GPUCC-INPUT-01: Model weights are loaded safely (not deserialized as code)¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | NVIDIA GPU Confidential Computing |
| Lifecycle stage | runtime |
| Policy | P-06: Host-supplied inputs are authenticated |
| Trust boundary | inputs |
| Assurance | operator-declared |
| Mode | Passive: reads only the files and values you pass to the scan. |
What a failure enables¶
- Attacker code runs inside the attested workload
How to fix¶
- Load weights with a data-only format (safetensors) or torch.load(weights_only=True); never unpickle untrusted checkpoints. Verify a signed model manifest with per-object digests before load, inside the TEE. Decouple code from data.
- Load weights via safetensors / torch.load(weights_only=True); verify a signed, digest-pinned manifest before load.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --gpu-kbs-policy or --gpu-weight-file specified; skipping check.
ERROR:
- Could not read/parse key-release policy: …
- Could not read weight file: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gpu-kbs-policy |
Key-release policy JSON: attest-before-ready, decrypt location. |
--gpu-weight-file |
Path to a model weight file; its leading bytes are sniffed to classify the real on-disk format (GPUCC-INPUT-01 bounded inspection). |
Permissions¶
None. The check reads only the files or values you pass to the scan.
Related¶
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).