Compressed pickle bypasses model scanners as joblib hides payload

A researcher showed that joblib.dump with compress= hides a malicious pickle from picklescan 1.0.4 and ModelScan: scanners see compressor magic bytes instead of pickle opcodes, while joblib.load transparently decompresses and executes the file. The open-source keras-model-scan toolkit now includes joblib_pickle_scan.py, which peels up to four compression layers in memory and disassembles the inner pickle without executing it.

• zlib, gzip, bz2, xz or lz4 compression hides pickle opcodes from scanners
• picklescan 1.0.4 and ModelScan miss compressed malicious joblib files
• The new scanner peels up to four layers in memory without executing code
• Rule JLB001 flags code-execution imports inside a compressed pickle