[repo-health] Medium: ml_analysis downloads ResNet18 weights from the internet at first use and only catches ImportError — offline runs crash instead of falling back

[Liohtml]

Summary

_build_feature_extractor() constructs models.resnet18(weights=IMAGENET1K_V1), which downloads weights from download.pytorch.org on first use. The surrounding fallback only catches ImportError ("PyTorch not installed"), so in an air-gapped/offline environment — the exact deployment the README's "on-device, nothing leaves your machine" pitch targets — the download raises URLError/RuntimeError and crashes the whole ml_analysis step instead of falling back to statistical features. The documented pre-fetch command is a stub.

Category

Robustness / Privacy-promise consistency

Severity

Medium

Location

• File: src/medcheck/pipeline/ml_analysis.py line 33 (weight download), line 107 (except ImportError: only)
• File: src/medcheck/main.py lines 292–296 (download_models prints "Model download coming in next release")

Details

model = models.resnet18(weights=models.ResNet18_Weights.IMAGENET1K_V1)  # network I/O on first run
...
except ImportError:
    # Fallback: simple statistical features when PyTorch not installed

Two separate problems:

1. An undocumented outbound network call in the "local, on-device" analysis path.
2. The fallback never triggers for download failures, only for a missing torch install.

Suggested Fix

1. Broaden the fallback to catch download/OS errors (e.g. except (ImportError, OSError, RuntimeError)) and log which fallback path was taken.
2. Implement medcheck download-models to pre-cache the weights for offline use.
3. Document the one-time weight download in README/docs (it currently contradicts "nothing leaves your machine" messaging — no PHI leaves, but the claim of fully-offline operation is wrong on first run).

Effort Estimate

1 h (fallback + docs); download-models implementation separate

---

Automated finding from repo health check (2026-07-10)