cyan oyster
PyTorch RVC models are not safe to use due to possible malicious code execution (https://huggingface.co/docs/hub/security-pickle). This can be partially mitigated by uploading a model to trusted sources (like huggingface, that checks pickled imports and may highlight possibility malicious code). But this approach is also error-prone, requires manual review and more sophisticated attacks can be applied that can be left undetected.
A possible approach could be:
- Forcing RVC developers to support safetensors format for inference and training (or at least provide tooling for conversion).
- Require model makers to provide/convert their models in safetensors format.
To smoothen transition, both pth and safetensors models may be supported and provided, but the use of pth models must be discouraged.
Don't expect anyone to drive this activity since this is not really about the server, but I'd like to at least bring awareness to this topic.
fresh river
wheat ember
sand spear