Housing-authority training workers load community models from pickle files while running with broad operating-system privileges. What risk should the pipeline redesign address?

Housing-authority training workers that load community models from pickle files while running with broad operating-system privileges create a classic unsafe-deserialization path. Certain serialization formats can execute arbitrary code during load. Pairing that behavior with privileged OS rights on municipal workers amplifies remote code execution into host takeover, credential theft from the training account, and lateral movement toward housing case systems. Pipeline redesign should prefer safer formats or hardened loaders, deny code execution during deserialization where possible, and run workers with least privilege so a malicious artifact cannot become a skeleton key to the training box. Reduced GPU utilization during pickle deserialization fails as the primary risk because performance is not the security failure mode. Missing emoji support in housing chatbot replies fails because user-interface tokenization issues are unrelated to loader remote code execution. Too many immutable tags in the model registry fails because registry-tagging discipline does not mitigate code execution on load. Exam caveat: municipal exams often pair pickle- or joblib-style loading with a privileged worker to test recognition of deserialization remote code execution plus privilege amplification, not concerns about ML accuracy. Practical check: ban or sandbox unsafe serializers on housing training nodes; run loaders as non-root with narrow filesystem and network rights; scan incoming community model packages before loading; and verify that registry-published formats are restricted to approved, non-executing representations.