re-ai-triage

AI Model Analysis Entry Point (Dispatcher)

Task Classifier (Input Form → Path)

After obtaining an AI-related target, first determine the input form; once matched, hand off to the corresponding skill:

Input Form	Path
Given a model file (.onnx / .pt / .pth / .safetensors / .tflite)	→ [[re-ai-model]](File layer: format parsing / structure restoration / weight extraction / file-level watermarking)
Only API (no file, black-box interface)	→ [[re-ai-attack]](Behavior layer: extraction / fingerprint / privacy / robustness assessment; guard authorization prerequisite)
Both file and API present	→ First [[re-ai-model]] (file-side forensics) → then [[re-ai-attack]] (behavior-side verification)
Malicious behavior discovered (poisoning / backdoor / malicious payload / download-and-execute)	→ Malicious analysis (currently: [[re-ai-model]] security boundary handling + [[re-behavior]]; in the future an independent re-ai-malware will take over)
Model packaged into an executable (PyInstaller/pyarmor, etc.)	→ First [[re-binary-core]] to unpack → the extracted model file returns to this skill for dispatch

When to Use / When Not to Use

• Use: when the user says "analyze this model / AI model security / model leakage" but does not specify the input form—dispatch first
• Use: when unsure whether the target is at the file layer or the behavior layer—identify first, then hand off
• Don't use: when the input form is already clear (go directly to [[re-ai-model]] or [[re-ai-attack]], without going through this skill)
• Don't use: non-AI targets (use the global entry point [[re-analyze]])
• Don't use: training / fine-tuning / deployment (not reverse engineering)

Tool Preparation

This skill only performs identification and dispatch, with lightweight tools:

python3 / file —— model file identification

• For python3 installation and verification, see [[re-python]] Tool Preparation
• file：Linux apt install file / dnf install file / pacman -S file(mostly preinstalled); verify file --version
• Verification:python3 -c "import struct"(standard library)

Model library probing (determine target dependencies, without loading the model)

• pip list 2>/dev/null | grep -iE 'torch|tensorflow|onnx'——confirm that this machine can parse the target format; if missing, downstream skills will guide installation

Operating Steps

1. Input Form Identification：
   • If the user provided a path/file → first file <path> + xxd <path> | head -2 take a quick look, then hand off to [[re-ai-model]]. Reliable signals for several forms (always trust the bytes, not the extension; for details see [[re-ai-model]] Step 1):
     • onnx: protobuf stream, no fixed magic number,file reports data; the first byte is the tag for ir_version 0x08，the second byte is the version number, which increases with the ONNX version (not a constant 08）；producer_name per the specification it only SHOULD appear
     • safetensors：file reports data——the first 8 bytes are the little-endian header length, followed by the JSON header (xxd -l 16 where the length segment is visible along with {）
     • pytorch: newer versions are zip containers,file reports Zip archive（PK\x03\x04 header),unzip -l visible data.pkl and other entries; the old-style is a bare pickle stream (no PK header,file often falsely reported as XENIX 8086 relocatable or i286 small model）——do not directly load, see [[re-ai-model]] pitfall 2
     • tflite: flatbuffers stream,file reports data; bytes 4–7 are the file identifier ASCII TFL3
   • User only has API endpoint/query capability → switch to [[re-ai-attack]]
   • Both present → follow the task classifier, files first then behavior
2. Target ownership confirmation: ownership of and authorization for the file/API (self-owned / authorized testing / CTF·research) — must be confirmed before behavioral-layer assessment ([[re-ai-attack]] guard prerequisite; for authorization context see triage step 0 RE_AUTH）
3. Handoff and record: specify the handoff skill + session variables (RE_GOAL、RE_AUTH, input-form marker), do not perform deep analysis in this skill

Cross-domain combination

• [[re-managed]]: this skill is the first hop of its AI branch (re-managed → re-ai-triage → re-ai-model / re-ai-attack)
• [[re-ai-model]]: file-layer downstream
• [[re-ai-attack]]: behavioral-layer downstream (guard authorization prerequisite)
• [[re-binary-core]]: unpacking prerequisite when the model is packaged into an executable
• [[re-behavior]]: malicious-behavior-side collaboration (behavioral determination of poisoning/backdoors)

Common pitfalls and traps

• Guessing the format from the file name：.pt may be pickle or may be a zip container (new torch format),.bin may be an arbitrary weight dump — rely on the file output and magic numbers, not the extension
• Going too deep in triage: this skill only identifies and hands off, it does not expand into analysis — doing deep analysis during the triage stage duplicates downstream work
• Missing authorization prerequisite: behavioral-layer assessment ([[re-ai-attack]]) has a guard authorization requirement — confirm before handoff RE_AUTH, and when ownership is unknown, ask first and do not directly enter the behavioral layer