Android AI Model Import MIME-Type Validation

Direct answer

Treat importing a local model as a validation pipeline, not as a file-extension check. Android’s Storage Access Framework lets the user choose a document through a provider and grants access using a content URI; the URI may represent local storage, removable storage, a cloud-backed provider, or a virtual document. The provider-reported MIME type and display name are useful hints for filtering and messaging, but they are not cryptographic proof of the file’s bytes or of runtime compatibility. Ask only for the access needed for the selected import flow, keep the URI grant tied to the task, and handle a provider that cannot return a stable stream. Before loading anything, collect privacy-safe metadata: provider authority, reported MIME type, display name, reported length if available, last-modified if provided, and whether the app can open the descriptor. Avoid logging full user paths or content. The user-facing picker can advertise supported MIME types, but the app must validate the selected result again because document providers may supply broad, missing, or unexpected labels. A filename ending in `.litertlm`, `.tflite`, or `.gguf` does not establish that the body matches that format; renaming a file does not convert it. Read through a bounded stream or descriptor and handle short reads, interruption, and provider failure. If importing requires a durable local copy, write to an app-owned temporary file with a clear size limit and cancellation path, then inspect the actual format using the selected runtime’s parser or a documented file signature where one exists. Do not decompress, deserialize, or allocate tensors based solely on untrusted metadata. Confirm that the artifact is permitted by the chosen runtime and app configuration before handing it to native code. Keep provenance distinct from validity: a user-selected file can be bytes-readable but unsupported, parser-valid but too large for the intended task, or loadable but still untested on the current device. For Cove-specific content, the current Gemma E2B configuration’s SHA-256 field is empty, so an import page must not suggest that Cove currently verifies the selected or shipped file against an official hash. Cove’s downloader’s optional digest verification only occurs when a digest is configured; that download path is not automatically equivalent to user-driven document import. Failure cleanup should delete only the app-owned partial temporary copy after confirming it is not the same as an existing valid artifact. Do not delete the user’s original document, ask for broad storage permissions unnecessarily, or overwrite a previously working model before the new import passes structural and load checks. Keep durable permission only when the product truly needs later reopen and the platform/API path supports it; otherwise copy to app storage and release the picker grant after the operation. A robust result model distinguishes permission denied, provider stream unavailable, empty input, oversized input, MIME mismatch, malformed header, unsupported format, parser error, digest absent or mismatch, storage full, cancelled import, native load failure, and successful import. The UI should explain a safe next step without exposing private content. Test with valid supported files, wrong extension, misleading MIME metadata, truncated bytes, oversized fixture, revoked access, provider cancellation, virtual documents, and low storage. Keep each fixture synthetic or authorized and record which validation layer caught it. Do not state that a file picker result is safe or compatible merely because Android returned a URI. A complete import path is: select with a minimal SAF contract; capture metadata and granted access; stream into a temporary app-owned location with limits; validate bytes and format independently; verify any configured digest; run the exact runtime’s open check; move into final storage only after success; and clean up on every failure. This article offers that procedure, not a claim that Cove supports arbitrary third-party model imports or any specific model format.

A user selects a model file from a document provider

A local AI app adds an “Import model” action. A provider returns a content URI with a plausible filename but a blank or generic MIME type. The team needs to reject malformed and unsupported data while preserving the user’s original file and avoiding broad storage access.

Decision

Treat picker metadata as hints, validate bytes and runtime format in an app-owned temporary copy, and keep provider access and import lifecycle explicit.

Expected outcome

The app accepts only a file that passes the configured checks, reports the exact failure layer, and never deletes or rewrites the provider’s original document.

Evidence to collect

The claim becomes reviewable only when the following evidence is attached to the same artifact and test run:

• Provider and import-grant fixtures
• Magic-byte and format validation
• Malformed-file rejection and cleanup

A completed byte stream is not enough. Final placement, integrity, runtime load, and recovery must also pass.

Implementation workflow

1. Request a narrow document selection. Use the Storage Access Framework for the intended open operation and advertise only useful MIME filters; treat the filter as picker assistance, not a security or format validator.
2. Capture the URI grant and provider metadata. Record the authority, reported MIME, display name, available length, and descriptor-open outcome without logging private paths or file content. Handle missing metadata and providers that stop streaming.
3. Copy to a bounded temporary location. Enforce an app-defined size ceiling, cancellation and free-space behavior while reading. Keep the original URI untouched and ensure the temporary path cannot replace the current valid model prematurely.
4. Validate actual bytes and format. Check the selected runtime’s supported format using its parser or documented signature checks; reject extension/MIME mismatches, truncated files, unsupported headers and malformed inputs before native loading.
5. Verify configured integrity and load. If a trusted digest is configured, compare it and report missing versus mismatch distinctly. Open the candidate with the exact runtime, move it to final storage only after success, and clean up app-owned partial data on every failure.

Keep each transition observable. A failure should identify the stage, artifact, runtime, and recovery action without logging private user content.

Acceptance criteria

• Provider MIME type, filename, URI grant, byte validation, parser support, optional digest and runtime load are recorded as separate checks.
• Malformed, truncated, oversized, revoked, cancelled and unsupported fixtures fail safely without deleting the provider’s original document.
• Only an app-owned temporary copy can be replaced or removed; existing valid model state remains intact if import fails.
• No claim of arbitrary-model support or verified Cove model digest is made without corresponding configuration and test evidence.

Decision table

Failure patterns to prevent

• Trusting MIME labels alone
• Requesting broad storage permissions

Also prevent silent fallback, unpinned artifacts, missing cancellation, and conclusions that combine unlike configurations. Store unsuccessful runs alongside successful ones.

Minimum reproducibility record

Release checklist

• ☐ The primary query is answered without an unsupported number.
• ☐ Every artifact and runtime is pinned.
• ☐ The representative task and failure policy are explicit.
• ☐ Lifecycle, cancellation, cleanup, and fallback are tested.
• ☐ User-content and network boundaries are documented.
• ☐ Result wording applies only to the recorded configuration.
• ☐ The page links to raw method or evidence when results are added.

Sources and related evidence

• Android privacy and security
• Android Developers — Access documents with the Storage Access Framework
• Android API — ContentResolver.getType(Uri)
• Android API — ContentResolver.openFileDescriptor(Uri,String)
• Cove ModelDownloader integrity and temporary-file behavior

Chinese deployment and troubleshooting content is organized in the .奇连 AI 端侧专题.

Frequently asked questions