Curated, deliberately corrupted checkpoints — poisoned tensors, tampered weights, malformed headers — each with a real saved scan report, annotated line by line. See exactly what the engine flags, and what most tools quietly miss.
Two checkpoints, same architecture, same tensor names and shapes. A hash-only integrity check sees nothing — structural diffing isolates the one rewritten block in seconds.
Two checkpoints, same architecture, same tensor names and shapes. A hash-only integrity check sees nothing — structural diffing isolates the one rewritten block in seconds.
The tokenizer.chat_template metadata field carries a Jinja2 import directive and an os.system() call — an SSTI payload most tools never even look at, since it's "just metadata".
One tensor declares a 2-billion-element dimension. The file is 5 KB. A naive loader computing buffer sizes from declared dims is heading for integer overflow or an out-of-memory crash before it reads a single weight.
A tensor declares a shape containing 0 — mathematically an empty tensor, but a shape most loaders never expect and don't defend against.
Epoch 1 vs. epoch 10 of the same run: every attention tensor identical, every feed-forward tensor rewritten. The diff shows exactly where a fine-tune went too far.
token_embd.weight has 32 rows. The file's own tokenizer.ggml.vocab_size metadata claims 999. Two fields in the same file disagree about the size of the vocabulary.
The safetensors header is just JSON with byte offsets. We patched one tensor's declared range to start inside another's — a memory-aliasing bug hiding in plain text.
One KV string entry declares a 65,535-byte length. Only 5 real bytes follow it. This is the same class of malformed input behind CVE-2024-23496, a critical heap buffer overflow in llama.cpp's own GGUF parser.
general.description carries a live <script> payload. Any hub, dashboard, or chat front end that renders GGUF metadata in a browser without escaping it turns this into stored XSS the moment someone views the model.
One tensor's name field declares a length of 0. It's spec-valid — nothing forbids an empty string — but it leaves that tensor unidentifiable, and parsers that assume a non-empty name when resolving offsets have crashed on exactly this input.
A tensor declares 32 bytes of data, but the next tensor's offset doesn't start until 200 bytes later. The 168 bytes in between aren't part of any declared tensor — and a loader that only reads known tensor regions never sees them.
The same string claims two different token IDs, and a hidden Unicode right-to-left override sits inside another token. Neither breaks the model's weights — both corrupt what a human ends up reading.