PICKLESCAN · GUIDE

Is this Hugging Face model safe to download?

You found a model on the Hub, but the weights are a pickle file (pytorch_model.bin, .pkl, .pt) from an account you don't know. Loading it can run arbitrary code on your machine before your own script does anything. Here's how to check it safely.

← Scan a model file now (free, nothing is stored)

Why a Hugging Face download can be dangerous

A large share of models on the Hub still ship pickle-serialized weights. Pickle isn't a data format — it's a stack language that can import os and call os.system(...) during torch.load() or joblib.load(). Hugging Face runs its own picklescan and now warns on flagged repos, but it does not catch everything, custom loaders and trust_remote_code=True bypass the check, and plenty of files predate it. Treat any third-party pickle as untrusted code, not data.

The one rule: prefer safetensors

If the repo has a model.safetensors file, download that instead of the .bin. safetensors stores pure tensor data with no code path, so it cannot execute anything on load. Pass use_safetensors=True to from_pretrained to force it. Only fall back to the pickle .bin if no safetensors file exists — and scan it first.

How to scan the pickle before loading it

Do not load it to inspect it — loading is the exploit. Disassemble the opcodes statically. You can eyeball it with the standard library:

python -m pickletools pytorch_model.bin | grep -i global

Any GLOBAL/STACK_GLOBAL importing os, posix, subprocess, socket, runpy, builtins.eval/exec or webbrowser is a red flag; a real model only imports its framework (torch, numpy, collections.OrderedDict). .bin files are ZIP containers, so the scanner has to unzip and read the embedded pickle — the free tool does all of that for you:

Scan the .bin / .pkl with PickleScan (free) →

Scanning every model in a repo or CI

Auditing one file by hand is fine; gating a fine-tuning pipeline or a model registry is not. PickleScan Pro is a zero-dependency CLI + GitHub Action that scans every artifact in a tree, emits JSON/SARIF, and fails the build on a dangerous file:

python picklescan_pro.py ./downloaded_models --fail-on dangerous
echo $?   # 0 = clean, 2 = dangerous file found
Get PickleScan Pro — one-time $29 →

Related

How to tell if a .pkl / .pt / .joblib model file is malicious — the deeper explainer on pickle exploitation.