Scan the model before you trust the model.
Probexa is a static security scanner for ML models — detecting unsafe serialization, remote-code-execution risks, malicious loaders and supply-chain weaknesses, all without ever executing the model.
Are you scanning your models?
Fast, safe, policy-driven.
Three principles make Probexa safe to run on untrusted models and easy to operationalize.
Static analysis only
Probexa scans model artifacts without executing them — safe for sensitive environments where unknown models must never be loaded into runtime.
Specialized ML coverage
Not a generic file scanner. Purpose-built scanners for ML formats, serialization, configs, dependencies, remote loaders and archives.
Policy-based decisions
Technical findings become clear Pass / Warn / Fail verdicts via configurable policy profiles for healthcare, finance and baseline use.
One scanner. The whole model supply chain.
Point Probexa at any model — open-source, vendor or internal. It statically inspects every artifact across six detection families, then returns a policy verdict, ranked findings and CI-ready outputs.
From model upload to risk verdict.
Submit
Upload a model bundle via dashboard, API, CLI or CI/CD.
Select policy
Choose healthcare, finance or baseline — or a custom TOML profile.
Static scan
Six detection families run in parallel — no model execution.
Review
Detailed findings plus 15+ model-hygiene metrics.
Act
A clear Pass, Warn or Fail verdict gates the model.
Tuned for regulated environments.
Apply different thresholds by sector, risk appetite and deployment context — all TOML-configurable.
Healthcare
For sensitive, PHI-adjacent workflows where model safety, auditability and vendor due diligence are critical.
Finance
Stricter controls on remote code loading, unsafe dependencies, model provenance and release approvals.
Global baseline
A strong default for general enterprise use, internal AI governance and standard MLOps controls.
Custom · TOML
Tune thresholds, allowlists and verdict logic without touching application code.
Blocking a risky vendor model before deployment.
A financial-services team receives a fraud-detection model from a third-party vendor, packaged as a ZIP and submitted to Probexa before entering the registry.
Built for modern AI engineering.
Run it where your teams already work, and surface findings in the tools they already use.
Web dashboard
Upload bundles, pick a profile, and view findings and risk metrics visually.
API & CLI
FastAPI endpoints and a CLI for portals, model registries and scripted pipelines.
GitHub Actions
A composite action for automated model scanning inside CI/CD.
SARIF & JSON
SARIF 2.1.0 for code scanning; JSON for SIEM, GRC and tickets. SBOM planned.
A security gate for your model supply chain.
Model registry intake
Scan every model before it enters your registry.
Vendor model review
Inspect third-party models before approval.
CI/CD security gate
Block unsafe models in PRs and releases.
MLOps governance
A repeatable check inside existing workflows.
Compliance evidence
Structured outputs for audit readiness.
High-risk AI review
Stricter profiles for regulated workloads.
Questions, answered.
Does Probexa execute the model?
No. Probexa is static analysis — it scans model bundles without loading or running the model, so untrusted models never reach your runtime.
What risks does it detect?
Unsafe pickle usage, dangerous code indicators, TensorFlow unsafe ops, Keras custom layers, ONNX anomalies, Hugging Face remote-loader patterns, dependency typosquatting, archive path traversal and suspicious weight patterns.
Can Probexa run in CI/CD?
Yes — a GitHub Actions composite action plus SARIF 2.1.0 output surface findings directly in GitHub code scanning and other SARIF-compatible tools.
Does it support policy customization?
Yes. Policies are TOML-based with configurable thresholds and allowlists; healthcare, finance and global-baseline profiles ship built in.
Is Probexa a replacement for AI red teaming?
No. Probexa focuses on static model-artifact and supply-chain scanning. It complements red teaming, model evaluation and runtime monitoring — including Sera and SafeEval.
Is it only for regulated industries?
No — any organization using ML models benefits. Regulated sectors gain most from the stronger governance, auditability and vendor controls.
Scan your models before they reach production.
Run a pilot scan on an internal, vendor or open-source model and see the findings, metrics and verdict for yourself.