| Base score | 100 |
| HIGH Duplicate vocabulary entries (1 token string(s) claim multiple IDs) | -15 |
| HIGH Hidden control/bidi-override characters in vocabulary (1+ found) | -15 |
| LOW No license field in GGUF metadata (general.license) | -3 |
| LOW No embedded provenance metadata | -3 |
| Penalty subtotal | 64/100 |
| Final | C / 64 |
| Runtime | Status | Quant | Architecture | Context |
|---|---|---|---|---|
| llama.cpp | ✓ | ? | ✓ | — |
| Ollama | ✓ | ? | ✓ | — |
| LM Studio | ✓ | ? | ✓ | — |
| vLLM | ✗ | N/A | GGUF not supported — requires safetensors format | |
| HuggingFace Transformers | ✗ | N/A | GGUF not directly supported — use safetensors or PyTorch checkpoint | |
| Architecture Neural network family — determines which runtime can load this model | llama |
| Quantization Weight storage format derived from actual tensor dtypes; lower bits = smaller file and faster inference at the cost of accuracy |
Mixed/Unknown |
| Tokenizer Tokenizer algorithm family (e.g. gpt2 = BPE, llama = SentencePiece) | llama |
| Chat template Jinja2 prompt template embedded in model; controls how messages are formatted for inference | ✗ No |
| SHA-256 | 74b288ed732cfc5d63f787a9378176be2e9b77b207362d343d53f5175e1cef8c |
| SHA-512 | 794dcf4aad00c79b2e8fe20a9950b577c8b9361a85bbaede8356758e2ff433447050e55ffa46f88f… |
| File size (bytes) | 280 |
| Header + KV + tensor directory | 288 bytes (0.00 MB) |
| Trailing bytes | 0 |
| Unaccounted bytes | -8 ✗ |
| KV metadata keys | 3 |
| Offsets monotone | ✓ OK |
{
"compatibility": [
{
"arch": true,
"container": true,
"context": null,
"notes": "GGUF v3 container: supported | quant Mixed/Unknown: supported",
"quant": null,
"runtime": "llama.cpp",
"supported": true
},
{
"arch": true,
"container": true,
"context": null,
"notes": "GGUF via llama.cpp backend: container and quantization supported",
"quant": null,
"runtime": "Ollama",
"supported": true
},
{
"arch": true,
"container": true,
"context": null,
"notes": "GGUF container and quantization supported; GPU/CPU inference",
"quant": null,
"runtime": "LM Studio",
"supported": true
},
{
"arch": null,
"container": false,
"context": null,
"not_supported_msg": "GGUF not supported \u2014 requires safetensors format",
"notes": "GGUF not supported; requires safetensors format",
"quant": false,
"runtime": "vLLM",
"supported": false
},
{
"arch": null,
"container": false,
"context": null,
"not_supported_msg": "GGUF not directly supported \u2014 use safetensors or PyTorch checkpoint",
"notes": "GGUF not supported; requires safetensors or PyTorch checkpoint",
"quant": false,
"runtime": "HuggingFace Transformers",
"supported": false
}
],
"format": "LLM-SCAN",
"format_version": "1.0",
"generator": {
"name": "llmscan-engine",
"version": "2.0.0"
},
"model": {
"alignment": 32,
"arch": "llama",
"architecture": "llama",
"basename": null,
"block_count": null,
"bos_token_id": null,
"chat_template": null,
"context_length": null,
"dtype_histogram": {},
"dtype_percentage": {},
"dtype_stats": {},
"embedding_length": null,
"eos_token_id": null,
"feed_forward_length": null,
"file_size_bytes": 280,
"file_size_mb": 0.0,
"finetune": null,
"format": "gguf",
"gguf_version": 3,
"has_chat_template": false,
"head_count": null,
"head_count_kv": null,
"header_kv_dir_bytes": 288,
"kv_count": 3,
"kv_meta": {
"keys": [
"general.architecture",
"tokenizer.ggml.model",
"tokenizer.ggml.tokens"
],
"kv_count": 3,
"values_redacted": true
},
"license": null,
"max_tensor_offset": 0,
"misaligned_tensors": 0,
"model_name": null,
"offsets_monotone": true,
"oob_tensor_count": 0,
"overlapping_tensor_pairs": 0,
"param_estimate": 0,
"params_estimate": 0,
"quantization": "Mixed/Unknown",
"scanner_model_info": {
"alignment": 32,
"architecture": "llama",
"basename": null,
"block_count": null,
"bos_token_id": null,
"chat_template": null,
"context_length": null,
"data_section_start": 288,
"dtype_histogram": {},
"dtype_percentage": {},
"dtype_stats": {},
"embedding_length": null,
"eos_token_id": null,
"feed_forward_length": null,
"file_size_bytes": 280,
"file_size_mb": 0.0,
"finetune": null,
"has_chat_template": false,
"head_count": null,
"head_count_kv": null,
"header_end_offset": 280,
"header_kv_dir_bytes": 288,
"kv_count": 3,
"kv_keys": [
"general.architecture",
"tokenizer.ggml.model",
"tokenizer.ggml.tokens"
],
"license": null,
"magic": "GGUF",
"max_tensor_offset": 0,
"misaligned_tensors": 0,
"model_name": null,
"offsets_monotone": true,
"oob_tensor_count": 0,
"overlapping_tensor_pairs": 0,
"param_estimate": 0,
"quantization": "Mixed/Unknown",
"sha256": "74b288ed732cfc5d63f787a9378176be2e9b77b207362d343d53f5175e1cef8c",
"sha512": "794dcf4aad00c79b2e8fe20a9950b577c8b9361a85bbaede8356758e2ff433447050e55ffa46f88fbab0eef2e86ec836df381eb324343072adbaa1d0e24e0b25",
"size_label": null,
"tensor_bytes_sum": 0,
"tensor_count": 0,
"tensor_delta_bytes": 280,
"tensor_delta_mb": 0.0,
"tensor_preview": [],
"tokenizer_model": "llama",
"top_tensors_by_size": [],
"trailing_bytes": 0,
"unaccounted_bytes": -8,
"version": 3,
"vocab_size": null
},
"sha256": "74b288ed732cfc5d63f787a9378176be2e9b77b207362d343d53f5175e1cef8c",
"sha512": "794dcf4aad00c79b2e8fe20a9950b577c8b9361a85bbaede8356758e2ff433447050e55ffa46f88fbab0eef2e86ec836df381eb324343072adbaa1d0e24e0b25",
"size_label": null,
"tensor_bytes_sum": 0,
"tensor_count": 0,
"tensor_delta_bytes": 280,
"tensor_delta_mb": 0.0,
"tensor_preview": [],
"tokenizer_model": "llama",
"top_tensors_by_size": [],
"trailing_bytes": 0,
"unaccounted_bytes": -8,
"values_redacted": true,
"vocab_size": null
},
"report": {
"bullets": [
"GGUF v3 model | architecture: llama | quantization: Mixed/Unknown | 0 tensors | 2 blocking issues / 2 warnings",
"SHA256: 74b288ed732cfc5d..."
],
"recommendations": [
"Reject this file; re-export the tokenizer from a trusted source",
"Reject this file; sanitize or reject vocabulary entries containing bidi-control or non-printable characters before rendering them anywhere",
"Add general.license to model metadata before distributing; use an SPDX identifier",
"Add at least one of: general.author, general.source.huggingface.repository, or general.source.url"
],
"summary": "GGUF v3 model | architecture: llama | quantization: Mixed/Unknown | 0 tensors | 2 blocking issues / 2 warnings"
},
"scan_context": {
"duration_ms": 0,
"ended_at": "2026-08-14T23:56:26+00:00Z",
"limits": {
"sandbox": true,
"timeout_ms": 60000
},
"mode": "static-deep",
"started_at": "2026-08-14T23:56:26+00:00Z"
},
"security": {
"findings": [
{
"category": "Tokenizer Integrity",
"detail": "Examples: [(\u0027hello\u0027, 3, 6)] (token, first id, duplicate id). A correctly produced vocabulary is a 1:1 mapping between string and ID; a repeated string at two IDs can make a detokenizer collapse two distinct tokens into one, or let a crafted ID silently decode to a different string than the one that was encoded.",
"recommendation": "Reject this file; re-export the tokenizer from a trusted source",
"severity": "HIGH",
"title": "Duplicate vocabulary entries (1 token string(s) claim multiple IDs)"
},
{
"category": "Tokenizer Integrity",
"detail": "Examples: [(\"\u0027ignore\\\\u202eprevious\u0027\", \u0027bidi-override\u0027)]. Unicode bidi-override characters (e.g. U+202E RIGHT-TO-LEFT OVERRIDE) and raw control bytes render invisibly or reorder surrounding text wherever a token is displayed -- chat UIs, terminals, logs -- without changing what the model itself processes.",
"recommendation": "Reject this file; sanitize or reject vocabulary entries containing bidi-control or non-printable characters before rendering them anywhere",
"severity": "HIGH",
"title": "Hidden control/bidi-override characters in vocabulary (1+ found)"
},
{
"category": "Supply Chain",
"detail": "Absence of license information makes it impossible to determine usage rights",
"recommendation": "Add general.license to model metadata before distributing; use an SPDX identifier",
"severity": "LOW",
"title": "No license field in GGUF metadata (general.license)"
},
{
"category": "Supply Chain",
"detail": "None of general.author, general.source.url, general.base_model.0, or general.source.huggingface.repository are embedded in the GGUF file. Without any origin signal the model cannot be traced to a trusted source or compared against a reference checkpoint for tampering detection. For files uploaded directly, provenance is especially critical because the scanner cannot infer repository origin from the file alone.",
"recommendation": "Add at least one of: general.author, general.source.huggingface.repository, or general.source.url",
"severity": "LOW",
"title": "No embedded provenance metadata"
}
],
"grade": "C",
"score": 64
},
"source": {
"filename": "tokenizer-tamper.gguf",
"hashes": {
"sha256": "74b288ed732cfc5d63f787a9378176be2e9b77b207362d343d53f5175e1cef8c"
},
"input_type": "file",
"size_bytes": 280
},
"tensors": {
"count": 0,
"dtype_histogram": {},
"dtype_stats": {},
"integrity": {
"header_kv_dir_bytes": 288,
"misaligned_tensors": 0,
"offsets_monotone": true,
"oob_tensor_count": 0,
"overlapping_tensor_pairs": 0,
"tensor_bytes_sum": 0,
"tensor_delta_bytes": 280,
"tensor_delta_mb": 0.0,
"trailing_bytes": 0,
"unaccounted_bytes": -8
},
"preview": []
},
"tokenizer": {
"bos_token_id": null,
"chat_template_chars": null,
"eos_token_id": null,
"has_chat_template": false,
"type": "llama",
"vocab_size": null
}
}