diff --git a/docs/freqai-configuration.md b/docs/freqai-configuration.md index 984a1f17b..09e1d313c 100644 --- a/docs/freqai-configuration.md +++ b/docs/freqai-configuration.md @@ -260,6 +260,10 @@ freqtrade trade --config config_examples/config_freqai.example.json --strategy F PyTorch dropped support for macOS x64 (intel based Apple devices) in version 2.3. Subsequently, freqtrade also dropped support for PyTorch on this platform. +!!! Danger "Security notice" + Loading saved models from disk can cause security issues if using remote model files (files you downloaded from the internet or received from an untrusted source) due to having the necessity to have `weights_only=False`, which can cause security problems. + As long as you only load models that you have trained yourself, there is no risk. + ### Structure #### Model diff --git a/docs/freqai-running.md b/docs/freqai-running.md index d506ac3ce..201f62497 100644 --- a/docs/freqai-running.md +++ b/docs/freqai-running.md @@ -87,6 +87,10 @@ To save the models generated during a particular backtest so that you can start To ensure that the model can be reused, freqAI will call your strategy with a dataframe of length 1. If your strategy requires more data than this to generate the same features, you can't reuse backtest predictions for live deployment and need to update your `identifier` for each new backtest. +!!! Danger "Security notice" + Loading saved models from disk can cause security issues if using remote model files (files you downloaded from the internet or received from an untrusted source) due to having the necessity to have `weights_only=False`, which can cause security problems. + As long as you only load models that you have trained yourself, there is no risk. + ### Backtest live collected predictions FreqAI allow you to reuse live historic predictions through the backtest parameter `--freqai-backtest-live-models`. This can be useful when you want to reuse predictions generated in dry/run for comparison or other study. diff --git a/freqtrade/freqai/data_drawer.py b/freqtrade/freqai/data_drawer.py index 5afa5a74a..960c822b5 100644 --- a/freqtrade/freqai/data_drawer.py +++ b/freqtrade/freqai/data_drawer.py @@ -614,9 +614,13 @@ class FreqaiDataDrawer: elif self.model_type == "pytorch": import torch - zipfile = torch.load(dk.data_path / f"{dk.model_filename}_model.zip") - model = zipfile["pytrainer"] - model = model.load_from_checkpoint(zipfile) + zipfile = torch.load( + dk.data_path / f"{dk.model_filename}_model.zip", + weights_only=False, + ) + # weights_only is necessary due to pytrainer being a serialized python object. + _trainer = zipfile["pytrainer"] + model = _trainer.load_from_checkpoint(zipfile) if not model: raise OperationalException(