You found a model on the Hub, but the weights are a pickle file
(pytorch_model.bin, .pkl, .pt) from an
account you don't know. Loading it can run arbitrary code on your machine
before your own script does anything. Here's how to check it safely.
A large share of models on the Hub still ship pickle-serialized weights.
Pickle isn't a data format — it's a stack language that can import os
and call os.system(...) during torch.load() or
joblib.load(). Hugging Face runs its own picklescan and now
warns on flagged repos, but it does not catch everything, custom loaders and
trust_remote_code=True bypass the check, and plenty of files predate
it. Treat any third-party pickle as untrusted code, not data.
safetensorsIf the repo has a model.safetensors file, download that instead of
the .bin. safetensors stores pure tensor data with no
code path, so it cannot execute anything on load. Pass
use_safetensors=True to from_pretrained to force it. Only
fall back to the pickle .bin if no safetensors file exists — and scan
it first.
Do not load it to inspect it — loading is the exploit. Disassemble the opcodes statically. You can eyeball it with the standard library:
python -m pickletools pytorch_model.bin | grep -i global
Any GLOBAL/STACK_GLOBAL importing os,
posix, subprocess, socket, runpy,
builtins.eval/exec or webbrowser is a red
flag; a real model only imports its framework (torch,
numpy, collections.OrderedDict). .bin files
are ZIP containers, so the scanner has to unzip and read the embedded pickle — the
free tool does all of that for you:
Auditing one file by hand is fine; gating a fine-tuning pipeline or a model registry is not. PickleScan Pro is a zero-dependency CLI + GitHub Action that scans every artifact in a tree, emits JSON/SARIF, and fails the build on a dangerous file:
python picklescan_pro.py ./downloaded_models --fail-on dangerous echo $? # 0 = clean, 2 = dangerous file foundGet PickleScan Pro — one-time $29 →
How to tell if a .pkl / .pt / .joblib model file is malicious — the deeper explainer on pickle exploitation.