No. Hub scanning is a useful signal, not a safety guarantee. Hugging Face runs a malware scan and a pickle import scan, and it states that the pickle scan is not 100 percent foolproof and that users are responsible for checking whether something is safe. Treat a clean badge as the start of review.
What the Hub scans
Two scans are described in the documentation.
- Malware scanning. Every file in a repository under 2 GB is run through a malware scanner at each commit. If at least one file is flagged unsafe, users see a warning.
- Pickle import scanning. When a pickled file is uploaded, the Hub extracts the list of imports it references and shows them beside the file. Suspicious imports are highlighted.
The pickle scan reads the file with pickletools, which can read instructions without running them. That is a sensible design, since it does not execute the thing it inspects.
What the documentation says about limits
Hugging Face is direct about this. It says the pickle scan is not 100 percent foolproof, that it is the user's responsibility to check whether something is safe, and that the safe and unsafe import lists are maintained on a best effort basis. It also says it is not actively auditing Python packages for safety.
It also explains that the antivirus scan covers a good amount of dangerous files but does not cover pickle exploits, which is why the second scan exists.
What a scan cannot tell you
| Question | Can a file scan answer it? |
|---|---|
| Does this pickle import a known dangerous function? | Often, with best effort lists |
| Is the modeling code in the repo doing something unexpected? | Only if it looks like known malware |
| Is the training data or the weights behavior safe? | No |
| Did the publisher change the repo since you reviewed it? | No, pin a commit |
| Is this account who it claims to be? | No, look at signed commits and history |
What you add on top
- Prefer non-pickle formats. Safetensors is the common choice.
- Load weights with restrictions. In PyTorch, use weights_only=True.
- Pin the commit. Our guide on pinning a model to a commit shows how.
- Avoid remote code by default. Review it first if you need it.
- Use a sandbox for the unknown. No credentials, no network, throwaway storage.
- Write down the decision. Who approved this model, when, and from which commit.
How to explain this to a manager
A short version works well: the platform is checking for known bad patterns, and we are checking whether this specific model is right for our environment. Both checks are needed. The first catches the obvious, and the second catches what only we know about our setup.
Where Safeguard fits
For the code and packages around the model, Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. A free scan is at gold.safeguard.sh/scan. For background, read AI model supply chain attacks.
Quick check
If a file shows no warning on the Hub, can I skip review?
No. A missing warning means the scanners found nothing they know about. Documentation from the host says users remain responsible for the safety check.
Do scans check model behavior?
The scans described in the docs look at files and pickle imports. They do not test how a model behaves.
Sources
Last reviewed: 19 October 2026.
