Stable-Diffusion-Pickle-Scanner-GUI VS safetensors

Pickle scanner: https://github.com/diStyApps/Stable-Diffusion-Pickle-Scanner-GUI

Did you do a pickle scan on it already? You can find Distys pickle scanner here. If it's clean, then you could load it into Auto1111 and just do a checkpoint merge of that model at "0" (Meaning 100%) and save it as safetensor.

Safetensor is a new file format for models. Checkpoints create a security risk, since they are Python code encapsulated in binary form, so a malicious actor could put whatever code they wanted in one of those, and which is why it's recommended that you only use .ckpt models from reputable sources or use a checker like this https://github.com/diStyApps/Stable-Diffusion-Pickle-Scanner-GUI to make sure they are "clean."

If you are concerned about malware being embedded in .ckpt files, you can use an online tool to scan the models, or my Stable-Diffusion-Pickle-Scanner-GUI tool to scan your models before converting them.

I also recently updated my Stable Diffusion Pickle Scanner GUI, which you can find here: https://github.com/diStyApps/Stable-Diffusion-Pickle-Scanner-GUI Let me know what you think and if you have any suggestions for improvement!

There is also an update for Stable-Diffusion-Pickle-Scanner-GUI https://github.com/diStyApps/Stable-Diffusion-Pickle-Scanner-GUI

The ML field is doing work in that area: https://github.com/huggingface/safetensors

FYI the file format, safetensors, was proposed, developed and maintained by HF, and involved people from groups such as Eleuther and Stability for external security audits.

https://github.com/huggingface/safetensors https://huggingface.co/blog/safetensors-security-audit

Thank you for note on this. I had not heard there were already trojan horse malware being slipped into tensor files as python scripts. Apparently torch pickle uses eval on the tensor file with no filter.

Heard surprisingly little commentary on this topic. The full explanation of how Safetensors are "Safe" can be found from the developer at: https://github.com/huggingface/safetensors/discussions/111

Here the developer goes into some detail about what kinds of protections .safetensor files have : https://github.com/huggingface/safetensors/discussions/111

Use the safetensors format, which allows safe persistence and loading of models for common libraries - TensorFlow, PyTorch, JAX, etc. We went through external audits in the last few months (blog post). The current direction will be to have this as the default format.

I've been diving in lately and while it's not efficient, the only way to do manage is to create a new conda/mamba environment, or a custom Docker image for all the conflicting packages.

For safety and speed, you should prefer the safetensor format: https://huggingface.co/docs/safetensors/speed

If you know what you are doing you can do your own conversions: https://github.com/huggingface/safetensors or for safety, https://huggingface.co/spaces/diffusers/convert

GitHub - huggingface/safetensors: Simple, safe way to store and distribute tensors