Yes, for internal handoffs. The Python documentation suggests signing pickled data with hmac so you can confirm it was not tampered with. Verify the signature before you unpickle anything. This proves the file came from someone holding the key, not that its contents are safe.
When this applies
Say one team trains a model and saves a pickled artifact. Another team loads it. The file travels through a bucket, a ticket attachment or a build cache. Anyone who can write to that path could swap in a hostile pickle. The Python docs warn that you should never unpickle data that could have come from an untrusted source or that could have been tampered with, and suggest signing data with hmac when you need to be sure it was not altered.
How it works
An HMAC is a keyed hash. The sender computes it over the file with a secret key and stores it beside the file. The receiver recomputes it with the same key and compares. A mismatch means the file changed or the key differs. Because an attacker without the key cannot produce a matching tag, a swapped file fails the check.
import hmac, hashlib
def sign(path, key):
with open(path, "rb") as f:
return hmac.new(key, f.read(), hashlib.sha256).hexdigest()
def verify(path, key, expected_hex):
actual = sign(path, key)
return hmac.compare_digest(actual, expected_hex)
Use compare_digest rather than a plain equality check so the comparison takes constant time. For very large files, read in chunks and feed them to the HMAC object.
Steps
- Generate a random key and store it in your secrets manager, not in the repo.
- Sign the artifact at the end of the training job and write the tag next to it.
- In the loading job, fetch the key, verify the tag, and stop on any mismatch.
- Only then unpickle, preferably with a restricted unpickler.
- Rotate the key on a schedule and when anyone with access leaves.
What this does and does not give you
| It gives you | It does not give you |
|---|---|
| Detection of tampering in transit or storage | Proof the producer was honest |
| A check that the file is the one your pipeline made | Protection if the signing key leaks |
| A cheap control with the standard library | Any benefit for files from outside your org |
If the producer is compromised, a perfectly signed file can still be hostile. And for models you download from a public hub, an HMAC with your own key is not available, since you do not hold the publisher's key. There you need other controls: trusted publishers, pinned revisions, non pickle formats and sandboxed loading.
The honest summary: signing closes the gap between "who wrote it" and "who handed it to me" inside your own walls. It does not make unpickling safe in general. The Python docs also list json as a better fit when data is untrusted.
Quick check
Is an HMAC the same as a digital signature?
No. An HMAC uses one shared secret, so anyone who can verify can also forge. A public key signature separates the two roles. For an internal pipeline, HMAC is often enough.
Should I verify before or after loading?
Before. Unpickling runs the code, so a check afterwards is too late.
Safeguard scans dependencies and generates SBOMs for your repositories, and policies and gates can block risky changes in pull requests. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
