AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 2 / c2.6
Enhanced AI Application SecurityDefense-in-depth layer: AI Application Capability 2 · Model customizationUse case: AI you build 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c2.6 Import models safely with Safetensors, not pickle

When importing a model customized elsewhere, use the Safetensors serialization format so untrusted artifacts cannot execute code on load.

Foundational
Enhanced
Advanced
Effort: Low Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 4 · Fine-tuned models; 5 · Self-trained models

Implementation guidance

How to implement on AWS

Use Amazon Bedrock Custom Model Import with Safetensors as the serialization format. Unlike pickle, Safetensors stores only tensor data (no arbitrary Python objects), eliminating code-execution risk from untrusted files. Validate the provenance of imported models.

Acceptance criteria

Imported models use Safetensors; no pickle-based artifacts are accepted; model provenance is recorded.

Practical implementation

How this control is implemented in each reference architecture:

Imported models enter through the Generative AI account only as Safetensors, with provenance recorded and pickle artifacts rejected before import.

  1. Use Amazon Bedrock Custom Model Import and accept only the Safetensors serialization format, which stores tensors without executable Python objects.
    Generative AI account Amazon Bedrock
  2. Reject pickle-based artifacts at the ingestion step and record the model's provenance (source, hash, approver) before import.
    Generative AI account Amazon S3 IAM
  3. Store approved import artifacts in a controlled bucket and log every import to the Log archive.
    Generative AI account → Log archive Amazon S3 CloudTrail

How to validate: Imported models are Safetensors; a pickle artifact is refused; provenance is recorded and the import is logged.

Avoid: Importing a pickle checkpoint from an untrusted source. Unpickling can execute arbitrary code; require Safetensors and verify provenance.

Generative AI OU (multi-account) →

Model imports in the account are restricted to Safetensors with recorded provenance, so an untrusted artifact cannot execute code on load.

  1. Use Bedrock Custom Model Import with Safetensors only; do not accept pickle-format artifacts.
    Generative AI tier (IAM role) Amazon Bedrock
  2. Record provenance (source, hash, approver) and store approved artifacts in a controlled bucket.
    Generative AI tier (IAM role) Amazon S3 IAM
  3. Log every import to the in-account log bucket.
    In-account logging CloudTrail Amazon S3

How to validate: Imports are Safetensors; pickle artifacts are refused; provenance is recorded and imports are logged.

Avoid: Loading community checkpoints in pickle format directly. Convert to and require Safetensors, and verify where the model came from.

Single account (entry point) →

Threats addressed

  • Arbitrary code execution from unpickling an untrusted model artifact.
  • Supply-chain compromise via a tampered imported model.

AWS services

Amazon Bedrock Amazon S3 AWS IAM

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM04 Supply Chain
  • LLM05 Data and Model Poisoning

NIST AI Risk Management Framework (AI 100-1)

  • GOVERN.6 Policies for third-party software, data and supply chain risk
  • MAP.4 Risks and impacts are mapped
  • MANAGE.3 Third-party risks and benefits are managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC06-BP01 Implement data purification filters for model training workflows

Learning resources

References

  • AWS SRA for AI — Capability 2, Rationale