Not by themselves. A verified signed commit shows that a commit came from the holder of a key, which supports checking origin. Hugging Face states that signing does not guarantee a file is safe, only where it came from. Use it to decide who to trust, then still review what you load.
What git does and does not check
The Hub documentation points out that git controls who can push to a repository, but it does not authenticate the actual authors of commits. Anyone can set a name and email on a commit. Signing closes that gap by tying a commit to a key.
On the Hub, a commit can show three states: Verified when it is signed and the signature checks out, Unverified when it is signed but the signature cannot be verified, and no signing status when it is not signed. For Verified, the public key must be uploaded to the account.
What a Verified badge tells you
- The commit was made by someone holding the private key linked to that account.
- The commit content was not changed after signing.
What it does not tell you
| You might assume | Reality |
|---|---|
| The files are safe | A trusted author can still publish a bad file by mistake, or after a compromise |
| The publisher is who they say they are in real life | It proves key ownership, not identity |
| Everything in the repo is signed | Only the commits that carry signatures |
| The latest commit is the one you reviewed | Pin a commit hash |
Hugging Face's own pickle guidance says signing does not guarantee your file is safe, but does guarantee its origin, and that if you know and trust user A and the commit is signed by A's key, it is pretty safe to assume you can trust the file. Read that as a judgment call about a known party, not a technical proof.
How to use signing in a model review
- Decide which publishers you recognize and write the list down.
- Check that the commit you plan to pin shows as Verified.
- Pin that exact commit. Our guide on pinning a model to a commit shows how.
- Prefer a non-pickle format and a restricted load.
- Re-check signatures when you move to a newer commit. A change in signer is worth a question.
If you publish models
Sign your commits. It is a small step that gives your users something to verify. The setup is covered in the Hub docs, and it takes a GPG key, uploading the public part to your account and signing commits with the signing flag.
git config user.signingkey <your key id>
git commit -S -m "Release 1.2"
Keep the private key protected, and rotate it if a laptop is lost.
Where Safeguard fits
For the code around your models, Safeguard offers SBOM and dependency scanning, policy gates and reachability analysis. Try a free scan at gold.safeguard.sh/scan. Related: model weights signing and attestation.
Quick check
Does an Unverified badge mean the model is malicious?
No. It means the commit was signed but the signature could not be verified, for example because a key was not uploaded. It does mean you cannot rely on the signature.
Is a signed commit better than a pinned hash?
They answer different questions. The signature speaks to who authored it, and the pin keeps you on the exact version you reviewed. Use both.
Sources
Last reviewed: 19 October 2026.
