gemma-2-9b-it-lora-yt-titles
Under review · AdamLucek/gemma-2-9b-it-lora-yt-titles WAS read against its base, offline and never run — but Vulcora publishes no signed dossier for it, so no verdict is claimed here either way: not a clean bill of health, and not an accusation. Check us yourself: https://api.vulcora.se/api/attestations/AdamLucek/gemma-2-9b-it-lora-yt-titles.
◆ Vulcora read it — and declined to rule. No matched benign reference resolved a verdict, so it is held, not cleared
Vulcora reads the weights- picklescanmmaitre314serialization exploit
reads pickle opcodes
detecting code-execution payloads embedded in Python pickle serialization — it answers 'does loading this file run code', not 'have these weights been tampered with'.
the scanner the HuggingFace Hub runs on upload
- ModelScanProtect AIserialization exploit
reads serialized-model opcodes (pickle, HDF5, SavedModel, NumPy)
scanning serialized model files for unsafe operators that execute code on load; like picklescan, it targets load-time code execution, not weight-level tampering.
load-time-exploit scanner, multi-format
- ficklingTrail of Bitsserialization exploit
reads pickle opcodes (static decompilation)
static analysis/decompilation of pickle streams; it marks any import outside the Python standard library as LIKELY_UNSAFE, which is conservative-by-design and fires on benign framework globals as well as malicious ones.
flags non-stdlib imports as LIKELY_UNSAFE, including benign ones
- modelauditpromptfooserialization exploit
reads manifests, configs, embedded templates & safetensors
heuristic auditing of a model repo for suspicious files, chat-template SSTI, non-allowlisted pickle globals, and license/provenance smells; a broad repo linter, not a weight-tampering detector.
artifact-only here: README/prose withheld (see policy)
- model-signingOpenSSF / Sigstoreprovenance
reads Sigstore signature bundles
verifying a cryptographic provenance signature over model files; it can only attest what a publisher signed.
requires a published Sigstore bundle; no scanned model ships one
Vulcora read the weights and declined to rule — held, not cleared.
Think this verdict is wrong?
Signed-in users can formally refute a read — Vulcora re-reads the model against your claim and records the outcome. You'll need an account to file one.
Refutations are actor-gated — a guest can't file one.
Want a verdict you can prove — on your own model?