Fix unsafe torch.load with weights_only=False

[Qiaochu Hu (hobostay)]

Summary

• Fix torch.load calls in demo/realtime_model_inference_from_file.py and demo/web/app.py to use weights_only=True
• Using weights_only=False allows arbitrary code execution via pickled objects in .pt files
• The loaded files contain dicts of tensors (cached prompt outputs) which are fully supported by weights_only=True in PyTorch 2.0+
• This aligns with the existing safe usage in vibevoice_tokenizer_processor.py which already uses weights_only=True

Details

Affected files:

• demo/realtime_model_inference_from_file.py (line 225)
• demo/web/app.py (line 161-164)

Security impact: If a malicious .pt file were provided (e.g., a poisoned voice preset), weights_only=False would allow it to execute arbitrary code on the host machine via Python's pickle deserialization.

Test plan

• Verify voice presets load correctly with weights_only=True
• Verify the loaded data structure is a dict of tensors (no custom Python objects)

🤖 Generated with Claude Code

[Rick Thomas (rickthomasjr)]

Review: Approve — weights_only=True for unsafe torch.load

Security concern addressed: weights_only=False in torch.load() allows arbitrary Python code execution via pickle deserialization (CWE-502).

Changes are minimal and correct:

• Two locations in demo code switched to weights_only=True
• These are demo/inference scripts used by end users loading third-party voice presets

One concern to flag: weights_only=True restricts types that can be loaded. If any voice presets were saved with custom Python objects (not just tensors/dicts), this will raise an error. Test against existing voice presets to ensure no regression. If presets use only standard types (tensors, dicts, lists), no issue.

Verdict: Approve. Good security hardening.