Use snapshot_download with allow_patterns or ignore_patterns to fetch only the files you want, for example the safetensors weights and JSON config, and skip .bin pickle files. Run a dry run first to see exactly what would be downloaded. Then pin the revision so the same files come back next time.
The problem with downloading the whole repository
Many model repositories hold several copies of the same weights in different formats. The Hugging Face download guide shows a listing for one popular repository with a pytorch_model.bin, a model.safetensors, TensorFlow, Flax, Rust and ONNX files side by side. If a tool pulls the whole snapshot, a pickle based file arrives on disk even if you plan to use the safetensors one.
That matters because a later script, or a teammate, might load the wrong file. Better if it never arrives.
Filter by pattern
The huggingface_hub library accepts glob patterns, based on fnmatch. The guide notes you may want to prevent downloading all .bin files if you only use .safetensors weights.
from huggingface_hub import snapshot_download
path = snapshot_download(
repo_id="org/model-name",
allow_patterns=["*.safetensors", "*.json", "*.txt", "*.md"],
revision="FULL_COMMIT_HASH_HERE",
)
print(path)
You can combine allow_patterns and ignore_patterns. The guide shows an example that downloads JSON and markdown files except one named file. Tokenizer files, for instance, may need an extension you did not list, so test with a small model first.
Check before you download
The guide documents a dry run option, which lists the files that would be fetched, with sizes, and tells you whether each is already cached. From the command line it looks like this.
hf download org/model-name --include "*.safetensors" "*.json" --dry-run
Read the list. If a pickle file shows up, your pattern is wrong. If no weights show up, the repository may only publish a pickle based format, which is itself something to decide on deliberately.
Pin the revision
The default is the latest version of the main branch, per the guide. A tag, a branch, a pull request reference or a commit hash can be passed through the revision parameter. The guide notes a commit hash must be the full length hash, not a seven character one. See the pin revision post linked below for why this matters.
What this does not do
Filtering controls what lands on disk. It does not verify the author, scan the weights, or tell you the model is good. Loading code in the repository, if you enable it, is a separate risk. Treat this as one layer.
Related: pin a Hugging Face model revision.
Wiring it into a build
Put the download in one small script that your Dockerfile or CI job calls, rather than letting application code fetch models at startup. The script holds the repository name, the pinned hash and the patterns. A reviewer can then see every change to those three values in a pull request. It also means a production container never needs outbound access to the Hub at runtime, because the files were fetched at build time and baked in or mounted.
Quick check
What if the repository only has pickle based weights?
Decide deliberately. Options include asking the maintainer for a safer format, using a different model, or loading in a sandbox with restricted loading turned on.
Does ignoring .bin files make the download safe?
It removes one risky file type from disk. You still need to trust the source and review any code the model repository asks you to run.
Sources
Last reviewed: 19 October 2026.
