4M Models Scanned: Protect AI + Hugging Face 6 Months In

Six months into their partnership, Hugging Face and Protect AI have some numbers worth sitting with. As of April 1, Protect AI's Guardian tool has scanned 4.47 million unique model versions across 1.41 million repositories on the Hub, and it flagged 352,000 unsafe or suspicious issues spread across 51,700 models. That's not a rounding error. That's tens of thousands of models people might have downloaded and run without knowing what was tucked inside.

The scale of scanning is only half the story. Guardian added four new detection modules since the partnership launched last October, targeting things like archive slip attacks that can write malicious files during model load, suspicious code execution in Joblib files, hidden architectural backdoors in TensorFlow SavedModels, and code that Llamafiles can quietly run at inference time. One of the bigger wins was catching CVE-2025-1550, a high-severity Keras vulnerability, before it was publicly disclosed. Guardian's detectors flagged affected models on Hugging Face ahead of the announcement, which is the kind of head start that actually matters in security work.

What's striking is how Protect AI describes the threat landscape evolving. Attackers aren't just stuffing malware into obvious places anymore. They're chaining vulnerabilities together — hiding payloads through compression or serialization tricks in formats like Joblib and Keras, exploiting extensibility features like custom layers, and combining multiple small flaws into attack paths that look innocent when you inspect any single piece. Protect AI compares some of this to the old