onecomp 1.2.0__tar.gz → 1.2.2__tar.gz

{onecomp-1.2.0/onecomp.egg-info → onecomp-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: onecomp
-Version: 1.2.0
+Version: 1.2.2
 Summary: Python package for LLM compression
 Author: Keiji Kimura
 License: MIT License
@@ -416,6 +416,12 @@ pip install vllm
 See the [vLLM Inference guide](https://FujitsuResearch.github.io/OneCompression/user-guide/vllm-inference/) for details, including Open WebUI setup instructions.
 
 
+## 📬 Contact Us
+
+- For technical questions and feature requests, please use GitHub [Issues](https://github.com/FujitsuResearch/OneCompression/issues).
+- For security vulnerabilities, please **do not** open a public Issue. See our [Security Policy](./SECURITY.md) for how to report them privately.
+- For collaborations, partnerships, and other inquiries, please contact us at [contact-onecompression@cs.jp.fujitsu.com](mailto:contact-onecompression@cs.jp.fujitsu.com).
+
 ## 📄 License
 
 See [LICENSE](./LICENSE) for more details.

{onecomp-1.2.0 → onecomp-1.2.2}/README.md

@@ -311,6 +311,12 @@ pip install vllm
 See the [vLLM Inference guide](https://FujitsuResearch.github.io/OneCompression/user-guide/vllm-inference/) for details, including Open WebUI setup instructions.
 
 
+## 📬 Contact Us
+
+- For technical questions and feature requests, please use GitHub [Issues](https://github.com/FujitsuResearch/OneCompression/issues).
+- For security vulnerabilities, please **do not** open a public Issue. See our [Security Policy](./SECURITY.md) for how to report them privately.
+- For collaborations, partnerships, and other inquiries, please contact us at [contact-onecompression@cs.jp.fujitsu.com](mailto:contact-onecompression@cs.jp.fujitsu.com).
+
 ## 📄 License
 
 See [LICENSE](./LICENSE) for more details.

{onecomp-1.2.0 → onecomp-1.2.2}/example/post_process/example_lora_sft.py

@@ -133,7 +133,11 @@ print("\n" + "=" * 70)
 print(f"Step 4: Loading model from {SAVE_DIR}")
 print("=" * 70)
 
-loaded_model, loaded_tokenizer = load_quantized_model_pt(SAVE_DIR)
+# SAVE_DIR was produced by this script (trusted), so we opt in to the
+# pickle-based .pt loader. Never enable this for untrusted model.pt files.
+loaded_model, loaded_tokenizer = load_quantized_model_pt(
+    SAVE_DIR, allow_unsafe_deserialization=True
+)
 print(f"Loaded model type : {type(loaded_model).__name__}")
 print(f"Loaded model device: {next(loaded_model.parameters()).device}")
 

{onecomp-1.2.0 → onecomp-1.2.2}/onecomp/__version__.py

@@ -6,4 +6,4 @@ Author: Keiji Kimura
 
 """
 
-__version__ = "1.2.0"
+__version__ = "1.2.2"

{onecomp-1.2.0 → onecomp-1.2.2}/onecomp/model_config.py

@@ -11,6 +11,7 @@ from logging import getLogger
 import torch
 from transformers import AutoConfig, AutoModelForCausalLM, AutoTokenizer
 
+from .utils.device import get_default_device
 from .utils.dtype import needs_bfloat16
 
 try:
@@ -114,6 +115,12 @@ class ModelConfig:
         self.logger.info("Model loaded with dtype=%s", next(model.parameters()).dtype)
         return model
 
+    def get_device(self) -> torch.device:
+        """Return a concrete torch.device for PyTorch operations."""
+        if self.device == "auto":
+            return get_default_device()
+        return torch.device(self.device)
+
     def load_tokenizer(self):
         """Load the tokenizer"""
 

{onecomp-1.2.0 → onecomp-1.2.2}/onecomp/post_process/post_process_lora_sft.py

@@ -298,6 +298,8 @@ class PostProcessLoraSFT(PostQuantizationProcess):
             >>> import torch
             >>> from onecomp import ModelConfig, PostProcessLoraSFT
             >>> model_config = ModelConfig(model_id="meta-llama/Llama-2-7b-hf")
+            >>> # weights_only=False uses pickle and can execute code from a
+            >>> # malicious file (CWE-502); only load trusted checkpoints.
             >>> quantized_model = torch.load(
             ...     "quantized_model.pt",
             ...     map_location="cpu",

{onecomp-1.2.0 → onecomp-1.2.2}/onecomp/quantized_model_loader.py

@@ -187,6 +187,7 @@ class QuantizedModelLoader:
         *,
         device_map: str = "auto",
         local_files_only: bool = True,
+        allow_unsafe_deserialization: bool = False,
     ) -> Tuple[Any, Any]:
         """Load a quantized model and tokenizer saved as a PyTorch .pt file.
 
@@ -198,18 +199,39 @@ class QuantizedModelLoader:
         - ``model.pt`` (serialized with ``torch.save``)
         - Tokenizer files
 
+        .. warning::
+            This method deserializes ``model.pt`` with
+            ``torch.load(..., weights_only=False)``. Because PyTorch ``.pt``
+            checkpoints use Python's ``pickle``, a maliciously crafted
+            ``model.pt`` can execute arbitrary code during deserialization
+            (CWE-502). ``weights_only=False`` is required here because the
+            ``.pt`` format preserves full custom module objects (e.g.
+            ``LoRAGPTQLinear``) that cannot be reconstructed from tensors
+            alone. Only load ``model.pt`` files that you produced yourself
+            or obtained from a fully trusted source. For untrusted or
+            third-party models, prefer the safetensors-based
+            :meth:`load_quantized_model`, which does not execute code.
+
         Args:
             save_directory: Path to the saved model directory.
             device_map: Device placement (default: ``"auto"``).
                 Set to ``""`` or ``None`` to skip device placement.
             local_files_only: Passed to ``AutoTokenizer.from_pretrained``.
+            allow_unsafe_deserialization: Must be explicitly set to ``True``
+                to acknowledge the unsafe-deserialization risk described
+                above and permit loading. Defaults to ``False``, in which
+                case this method raises before any code can be executed.
 
         Returns:
             (model, tokenizer)
 
+        Raises:
+            ValueError: If ``allow_unsafe_deserialization`` is not ``True``.
+
         Example:
             >>> model, tokenizer = QuantizedModelLoader.load_quantized_model_pt(
-            ...     "./quantized_model_lora"
+            ...     "./quantized_model_lora",
+            ...     allow_unsafe_deserialization=True,  # trusted source only
             ... )
         """
         save_directory = os.path.abspath(save_directory)
@@ -224,6 +246,24 @@ class QuantizedModelLoader:
                 "(safetensors format); use load_quantized_model() instead."
             )
 
+        if not allow_unsafe_deserialization:
+            raise ValueError(
+                f"Refusing to load '{model_path}': loading a .pt model uses "
+                "torch.load(weights_only=False), which deserializes arbitrary "
+                "Python objects via pickle and can execute code embedded in a "
+                "malicious file (CWE-502). Only load model.pt files you produced "
+                "yourself or obtained from a fully trusted source, then pass "
+                "allow_unsafe_deserialization=True to acknowledge this risk. "
+                "For untrusted or third-party models, use the safetensors-based "
+                "load_quantized_model() instead."
+            )
+
+        logger.warning(
+            "Loading '%s' with torch.load(weights_only=False); arbitrary code in "
+            "a malicious checkpoint can execute during deserialization. Ensure "
+            "this model.pt comes from a trusted source.",
+            model_path,
+        )
         model = torch.load(model_path, map_location="cpu", weights_only=False)
 
         if device_map:

{onecomp-1.2.0 → onecomp-1.2.2}/onecomp/quantizer/_quantizer.py

@@ -641,22 +641,40 @@ class Quantizer(metaclass=ABCMeta):
         torch.save(self.results, filepath)
         self.logger.info("Saved quantization results to %s", filepath)
 
-    def load_results(self, filepath, weights_only=False):
+    def load_results(self, filepath, *, weights_only=False, allow_unsafe_deserialization=False):
         """Load the quantization results from a file into self.results.
 
         Loads saved quantization results and stores them in self.results.
 
+        .. warning::
+            With ``weights_only=False`` this method deserializes arbitrary
+            Python objects via ``torch.load`` / ``pickle``, so a maliciously
+            crafted file can execute code during deserialization (CWE-502).
+            Only load result files you produced yourself or obtained from a
+            fully trusted source, and set ``allow_unsafe_deserialization=True``
+            to acknowledge the risk.
+
         Args:
             filepath (str): The path to load the results from.
             weights_only (bool): If True, only load tensor weights (safer but limited).
                 Default is False to support loading QuantizationResult objects.
+            allow_unsafe_deserialization (bool): Required to be True when
+                ``weights_only`` is False, to acknowledge the
+                unsafe-deserialization risk. Ignored when ``weights_only`` is
+                True (that path is safe). Defaults to False.
 
         Returns:
             dict: A dict mapping layer name -> QuantizationResult (same reference as self.results).
 
+        Raises:
+            ValueError: If ``weights_only`` is False and
+                ``allow_unsafe_deserialization`` is not True.
+
         Example:
             >>> quantizer = JointQ()
-            >>> quantizer.load_results("quantization_results.pt")
+            >>> quantizer.load_results(
+            ...     "quantization_results.pt", allow_unsafe_deserialization=True
+            ... )
             >>> for layer_name, result in quantizer.results.items():
             ...     print(f"{layer_name}: {result.dequantized_weight.shape}")
 
@@ -667,6 +685,22 @@ class Quantizer(metaclass=ABCMeta):
             - Loading files saved with older versions may fail if class
               definitions have changed.
         """
+        if not weights_only and not allow_unsafe_deserialization:
+            raise ValueError(
+                f"Refusing to load '{filepath}': loading with weights_only=False "
+                "deserializes arbitrary Python objects via pickle and can execute "
+                "code embedded in a malicious file (CWE-502). Only load result "
+                "files from a fully trusted source, then pass "
+                "allow_unsafe_deserialization=True to acknowledge this risk, or "
+                "use weights_only=True for the safe (tensors-only) path."
+            )
+        if not weights_only:
+            self.logger.warning(
+                "Loading '%s' with weights_only=False; arbitrary code in a "
+                "malicious file can execute during deserialization. Ensure this "
+                "file comes from a trusted source.",
+                filepath,
+            )
         self.results = torch.load(filepath, weights_only=weights_only)
         self.logger.info("Loaded quantization results from %s", filepath)
         return self.results
@@ -951,6 +985,9 @@ class ResultLoader(Quantizer):
     # Optional: load precomputed results at initialization time
     results_file: str = None
     weights_only: bool = False
+    # Required to be True when weights_only is False, to acknowledge the
+    # unsafe-deserialization risk of torch.load(weights_only=False) (CWE-502).
+    allow_unsafe_deserialization: bool = False
 
     # Ensure no layers are selected for quantization by default
     target_layer_types: tuple = field(default_factory=tuple)
@@ -962,7 +999,11 @@ class ResultLoader(Quantizer):
     def __post_init__(self):
         super().__post_init__()
         if self.results_file is not None:
-            self.load_results(self.results_file, weights_only=self.weights_only)
+            self.load_results(
+                self.results_file,
+                weights_only=self.weights_only,
+                allow_unsafe_deserialization=self.allow_unsafe_deserialization,
+            )
 
     def setup(self, model):  # pylint: disable=unused-argument
         """Select no layers (no-op).

{onecomp-1.2.0 → onecomp-1.2.2}/onecomp/runner.py

@@ -327,7 +327,7 @@ class Runner:
 
         # MPS device validation: only GPTQ (or AutoBitQuantizer whose
         # candidates are all GPTQ, without DBF fallback) is supported on MPS
-        device = self.model_config.device
+        device = self.model_config.get_device()
         if is_mps_device(device):
             if self.multi_gpu:
                 raise ValueError("multi_gpu is not supported on MPS device.")
@@ -1139,24 +1139,24 @@ class Runner:
             tokenizer = self.model_config.load_tokenizer()
             original_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
             del model, tokenizer
-            empty_cache(self.model_config.device)
+            empty_cache(self.model_config.get_device())
 
         if quantized_model:
             try:
                 logger.info("Evaluating quantized model (%s)...", eval_name)
                 if self.quantized_model is not None:
                     model = self.quantized_model
-                    model.to(self.model_config.device)
+                    model.to(self.model_config.get_device())
                     tokenizer = self.model_config.load_tokenizer()
                     quantized_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
                     model.to("cpu")
                     del tokenizer
                 else:
                     model, tokenizer = self.create_quantized_model(quantizer=quantizer)
-                    model.to(self.model_config.device)
+                    model.to(self.model_config.get_device())
                     quantized_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
                     del model, tokenizer
-                empty_cache(self.model_config.device)
+                empty_cache(self.model_config.get_device())
             except NotImplementedError:
                 logger.warning(
                     "This quantization method does not support creating a quantized model; "
@@ -1171,7 +1171,7 @@ class Runner:
             self.update_model_weights(model, quantizer=quantizer)
             dequantized_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
             del model, tokenizer
-            empty_cache(self.model_config.device)
+            empty_cache(self.model_config.get_device())
 
         return original_result, dequantized_result, quantized_result
 
@@ -2117,7 +2117,7 @@ class Runner:
             )
             # Release fragmented GPU memory from previous operations (e.g., run())
             gc.collect()
-            empty_cache(self.model_config.device)
+            empty_cache(self.model_config.get_device())
 
             model = self.model_config.load_model()
             input_device = next(model.parameters()).device
@@ -2141,7 +2141,7 @@ class Runner:
                 )
                 # Release fragmented GPU memory from previous operations (e.g., run())
                 gc.collect()
-                empty_cache(self.model_config.device)
+                empty_cache(self.model_config.get_device())
 
                 model = self.model_config.load_model()
                 input_device = next(model.parameters()).device

{onecomp-1.2.0 → onecomp-1.2.2/onecomp.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: onecomp
-Version: 1.2.0
+Version: 1.2.2
 Summary: Python package for LLM compression
 Author: Keiji Kimura
 License: MIT License
@@ -416,6 +416,12 @@ pip install vllm
 See the [vLLM Inference guide](https://FujitsuResearch.github.io/OneCompression/user-guide/vllm-inference/) for details, including Open WebUI setup instructions.
 
 
+## 📬 Contact Us
+
+- For technical questions and feature requests, please use GitHub [Issues](https://github.com/FujitsuResearch/OneCompression/issues).
+- For security vulnerabilities, please **do not** open a public Issue. See our [Security Policy](./SECURITY.md) for how to report them privately.
+- For collaborations, partnerships, and other inquiries, please contact us at [contact-onecompression@cs.jp.fujitsu.com](mailto:contact-onecompression@cs.jp.fujitsu.com).
+
 ## 📄 License
 
 See [LICENSE](./LICENSE) for more details.