Model Package Security

Configure per-model authorization and local or untrusted model package loading without confusing them with server authentication.

Model loading and server access use separate controls. Granting a client access to the server does not make every model package safe to execute.

Check Security Configuration Migration for which changes are merged and which are pending.

Server access and model authorization

WORKSPACES_WHITELISTED_FOR_LOCAL_DEPLOYMENT controls which Workspaces can call the server, including its integrated stream management routes. MODELS_CACHE_AUTH_ENABLED=True checks whether the caller's API key may access the requested Roboflow model when the server is online. Model authorization is not a replacement for server authentication.

Direct local packages

For trusted local packages in server Workflows, enable these settings and mount the package directory into the container:

USE_INFERENCE_MODELS=True
ALLOW_INFERENCE_MODELS_DIRECTLY_ACCESS_LOCAL_PACKAGES=True
MODELS_CACHE_AUTH_ENABLED=False

This allows callers to load readable local model packages, including their Python code. The local loading path does not itself require an API key, but any configured Workspace authentication still applies to the request.

An online server rejects startup if both MODELS_CACHE_AUTH_ENABLED=True and ALLOW_INFERENCE_MODELS_DIRECTLY_ACCESS_LOCAL_PACKAGES=True. Keep local loading disabled when you require per-model authorization; a filesystem path cannot be checked against a caller's Roboflow model access.

Offline authorization

When OFFLINE_MODE=True, per-model API-key checks cannot run. If MODELS_CACHE_AUTH_ENABLED=True is also set, startup requires the explicit ALLOW_OFFLINE_MODEL_CACHE_AUTH_BYPASS=True opt-in. Use that bypass only for a trusted single-tenant deployment; it does not make API-key checks work offline.

Offline mode also rejects Workspace-whitelist or Dedicated Deployment authentication, which needs API connectivity. See Offline Mode for deployment context.

Package trust defaults

In the pending runtime-hardening build described in the migration guide, JetPack 5.1.1, 6.2.0, and 7.2.0 images set ALLOW_INFERENCE_MODELS_UNTRUSTED_PACKAGES=False, matching the core library's default. To load a package classified as untrusted, explicitly set it to True only after reviewing the package and its source.

This setting is separate from ALLOW_INFERENCE_MODELS_DIRECTLY_ACCESS_LOCAL_PACKAGES: rejecting untrusted downloaded packages does not disable direct local package loading. Neither setting replaces caller authentication.

CLI benchmarks

The pending runtime-hardening build also changes inference benchmark inference-models-speed to reject untrusted packages by default. Use --allow-untrusted-packages when you deliberately trust the package; the adapter and Python benchmark helper use the same restrictive default.

For benchmark usage, see Benchmark Inference.