🛠️ Lab 10 — Scan, Convert, and Rank Model Trust Signals (50 pts)

Goal: Use free, open-source tools to detect an unsafe pickle-format model, convert a model to the safer safetensors format, and evaluate real Hugging Face model repos on supply-chain trust signals instead of popularity alone. Steps:

1. In a local Python environment (venv or conda), install ModelScan from Protect AI: pip install modelscan. Confirm it runs with modelscan --help.
2. Download a small, free pickle-format or .bin model checkpoint from Hugging Face (pick something small, e.g., a tiny sentiment classifier or a small .pt file from a public repo) using huggingface-cli or the hf CLI. Run modelscan -p <path-to-model> against it and record the scan output.
3. Craft a small benign "malicious" pickle yourself: write a short Python script that pickles an object whose __reduce__ method would call an obviously harmless command (e.g., printing a message) — do not use any destructive or network-calling payload. Save it as a .pkl file and run ModelScan against it. Confirm ModelScan flags it and note what the finding says (severity, operator name, description).
4. Take the small model from Step 2 (or any small pickle/.bin model you have locally) and convert it to safetensors using the free, open-source safetensors library (e.g., torch.save → load state dict → safetensors.torch.save_file). Keep both the original and converted files.
5. Run ModelScan again, this time against the converted safetensors file. Compare the two scan outputs side by side.
6. In your own words (150–250 words), explain why the safetensors version is not flagged the same way the pickle version is — connect this to how each format is deserialized.
7. Go to Hugging Face and find three real, public model repos (any task, your choice). For each, check its "Safe" badge / safetensors status and any visible security-scan indicators (pickle scan, ModelScan, JFrog badges) on the repo's Files page. Build a simple ranking of the three models from most to least trustworthy based only on these visible supply-chain signals (not on downloads or star count).

Deliverables: A short lab report (Word doc or PDF, uploaded) containing: (1) your ModelScan output for the pickle model, the crafted "malicious" pickle, and the converted safetensors file; (2) your 150–250 word explanation from Step 6; (3) your three-model trust ranking from Step 7 with a one-sentence justification for each. Also paste your crafted pickle-creation script into the text-entry box for this assignment.