ml-securitylisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/ml-security/SKILL.md. --> # ML Model Security Model artifact loading (pickle vs safetensors), model & data poisoning, PII in training data, secrets in notebooks, model provenance / lineage ## ALWAYS - When loading models, use **safetensors** for PyTorch and Hugging Face; use `weights_only=True` with `torch.load` on PyTorch 2.4+; never load arbitrary `.pkl` / `.pt` files from untrusted sources. - Verify **provenance / lineage** of any third-party or externally fine-tuned model — known author, signed or hashed checkpoint, recorded source — before loading it. - Pin and hash **model + dataset versions** and record them, so a poisoned artifact can be traced and rolled back. - Scrub PII, credentials, and secrets from training / fine-tuning data — at the source (ingestion), at storage (encryption + access control), and in anything committed to the repo. - Treat ML notebooks as code: no plaintext credentials in cells or cell output, and clear outputs before committing. ## NEVER - `pickle.loads` / `joblib.load` / `dill.loads` / `torch.load` an artifact fetched at runtime from an untrusted source. These deserializers execute arbitrary code by design. - Use a model fine-tuned or distributed by an external party without provenance / lineage verification. - Store training-data examples that contain PII in long-term