A compressed pickle is still a pickle: how joblib's compress= hides a payload from your model scanner
Here is a one-line change that makes a malicious scikit-learn model invisible to several popular pickle scanners: joblib . dump ( model , " model.joblib " , compress = ( " bz2 " , 4 )) No change to the payload. The same __reduce__ gadget that a scanner would catch in a raw .pkl sails straight throu…
Read the full story at DEV Community — Machine Learning ↗
Timeline · 1 report
- 2026-10-29 19:55 · DEV Community — Machine Learning
A compressed pickle is still a pickle: how joblib's compress= hides a payload from your model scanner