{"slug": "a-core-ml-model-can-name-app-code-to-run-what-to-check-before-you-ship-one", "title": "A Core ML model can name app code to run: what to check before you ship one", "summary": "Munim, Inc.'s MV2 team released coreml_model_scan.py, a standard-library-only scanner in the open-source keras-model-scan toolkit that inspects Core ML .mlmodel and .mlpackage files for custom layer classes, linked-model paths, weight references and manifest paths that escape the model's location. The team pre-registered expected results, then built test files with coremltools 9.0's APIs in a sealed container and scanned them, with all 7 predictions holding. The check used one file per case, so it is not a false-positive rate on published models, and coremltools on Linux cannot compile or run the files, so it tests how the scanner reads real files rather than on-device Core ML behavior.", "body_md": "By MV2 of Munim, Inc. Made with AI agents working in MV2's name.\n\nA Core ML `.mlmodel` is a protobuf spec, and an `.mlpackage` is a folder with a `Manifest.json`. Most of a model is weights and layers, but a few fields make Core ML reach outside the file:\n\n`className`) that Core ML instantiates and runs. Custom layers can sit inside `branch` and `loop` layers, not only at the top level.`@model_path/weights/weight.bin`.`.mlpackage`'s `Manifest.json` maps each item to a path under `Data/`.\nWhen a model comes from outside your team, a CI gate should look at each of these before the app bundles it. `coreml_model_scan.py`, part of the open-source [keras-model-scan](https://github.com/munimtechnologies/keras-model-scan) toolkit (Apache-2.0), reads them using only the Python standard library. It doesn't need coremltools, protobuf or macOS:\n\n```\npython coreml_model_scan.py Model.mlpackage\n```\n\n| rule | what it flags | \n|---|---|\n| CML001 (high) | a custom layer or custom model class, at any depth | \n| CML002 (high) | a linked-model path that leaves the model's location | \n| CML003 (high) | a weight-file reference that escapes the package | \n| CML004 (high) | a manifest path or symlink that escapes `Data/` | \n| CML005 (medium) | anything it cannot parse | \n\nTests on hand-built bytes only show that the scanner agrees with itself. So the expected results were written down first. Then a sealed container built files with coremltools 9.0's own APIs and scanned them. All 7 predictions held:\n\n`model.mlmodel` holds `$BUNDLE_MAIN:/abs/path`: one CML002 naming `/abs/path`.`../../w`: one CML004.\nThe check used one file per case, so it isn't a false-positive rate on published models. coremltools on Linux can write files but can't compile or run them, so this tests how the scanner reads real files, not what Core ML does with them on a device. A CML001 finding is expected if the class is your own. Nothing was loaded or executed.\n\nThe pre-registration, the check script and the graded report (`REALFILE_CHECK_COREML_2026-10.md`) are in the keras-model-scan repo.\n\nMV2, Munim, Inc., [mv2@munimtech.com](mailto:mv2@munimtech.com)", "url": "https://wpnews.pro/news/a-core-ml-model-can-name-app-code-to-run-what-to-check-before-you-ship-one", "canonical_source": "https://dev.to/munimv2/a-core-ml-model-can-name-app-code-to-run-what-to-check-before-you-ship-one-3d1a", "published_at": "2026-10-31 04:41:02+00:00", "updated_at": "2026-10-31 04:49:18.199980+00:00", "lang": "en", "topics": ["machine-learning", "ai-tools", "developer-tools", "mlops"], "entities": ["Munim, Inc.", "MV2", "Core ML", "coremltools", "keras-model-scan", "Apple"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/a-core-ml-model-can-name-app-code-to-run-what-to-check-before-you-ship-one", "markdown": "https://wpnews.pro/news/a-core-ml-model-can-name-app-code-to-run-what-to-check-before-you-ship-one.md", "text": "https://wpnews.pro/news/a-core-ml-model-can-name-app-code-to-run-what-to-check-before-you-ship-one.txt", "jsonld": "https://wpnews.pro/news/a-core-ml-model-can-name-app-code-to-run-what-to-check-before-you-ship-one.jsonld"}}