You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

SafeTensors Binary Header dtype Coercion — PoC

Finding: safetensors.numpy.load_file() and safe_open() silently return int32 tensors when a binary .safetensors file has its header dtype field mutated from F32 to I32. No exception, no warning. The binary weight payload is bit-identical; only the 3-byte dtype string in the JSON header differs.

Affected library: safetensors 0.7.0 (numpy consumer path)

Route: huntr MFV

Files

File	Description
`baseline.safetensors`	Clean 2-class MLP — W1/W2/b1/b2 all dtype F32
`mutant_i32.safetensors`	Mutated — W1 header dtype changed F32→I32 (3-byte patch); data section bit-identical
`reproduce_numpy.py`	End-to-end assertion suite (A1–A6); confirms silent int32 return + logit corruption
`inspect_artifacts.py`	Verifies structural identity: only header dtype differs
`default_consumer_results.json`	Runtime evidence — numpy consumer load_file() + safe_open() results
`inspector_differential.json`	Header/payload differential between baseline and mutant

Mutation

Header field:  "dtype": "F32"  →  "dtype": "I32"
Bytes changed: 3
File size:     516 bytes (UNCHANGED)
Data section:  bit-identical (binary weight bytes UNCHANGED)

The safetensors format stores per-tensor dtype as a text string in the JSON header (preceded by an 8-byte LE uint64 length prefix). F32 and I32 are both 4 bytes/element, so safetensors offset/size validation passes. The library returns int32 tensors where float32 is expected — silently.

Reproduce

pip install "safetensors>=0.7.0" numpy
python3 reproduce_numpy.py

Expected output:

A1 PASS: baseline load, dtype=float32
A2 PASS: mutant load OK, no exception, W1.dtype=int32
A3 PASS: W1 bit patterns identical (float32 and int32 views of same bytes)
A4 PASS: logit corruption ratio=8.16e+09x
A5 PASS: 6/10 prediction flips
A6 PASS: safe_open shows int32 on mutant W1 (no warning)
ALL_PASS

Evidence Summary

Metric	Value
A1 baseline load	PASS (float32)
A2 mutant load — exception?	PASS — NO exception, NO warning
A3 binary payload	bit-identical
A4 logit corruption ratio	8.16 × 10⁹×
A5 prediction flips	6/10 (seed=69)
A6 safe_open dtype	int32 (no warning)

SHA256

File	SHA256
baseline.safetensors	`43450d818cf86e743d5020479cf6b4ce9b5ff6a75eef4df9bc8302c18368d8e7`
mutant_i32.safetensors	`37944b4320abc87edc9b9e0034dc5bfb2dda41efc3c180ff9f2ac91db07ab19e`

Scope Limitation

This PoC covers the safetensors.numpy consumer path (load_file() and safe_open(framework="np")).

safetensors.torch consumer: not tested (environment constraint)
torch.nn.Module.load_state_dict(): not tested — may reject int32 when float32 is expected
transformers default model loading: not tested

This report does not claim RCE, memory corruption, High/Critical severity, or that all safetensors consumers are affected.

Access

Gated access (manual review required). protectai-bot access granted.

HF repo: PLACEHOLDER

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support