Convert in a sandbox. Converting a pickle checkpoint to safetensors means loading the pickle first, and loading is where the risk sits. Use a throwaway environment with no secrets and no network, load with weights only mode, save the tensors, then record the new file's digest and origin.
The catch most guides skip
A conversion script does two things: read the old file, write the new one. The read step is the dangerous one. The Python documentation says malicious pickle data can execute arbitrary code during unpickling. Converting a file you do not trust, on a machine that holds credentials, can hand an attacker the very access you were trying to protect.
So the format change makes later loads safer, but the conversion itself needs to be treated like opening an unknown attachment.
A safer conversion routine
- Create a disposable environment: a container or short lived VM with no network access, no mounted secrets and no cloud credentials.
- Copy the checkpoint into it. Record the source, revision and SHA256 of the original first.
- Load with the strictest mode available. PyTorch's torch.load documents a weights only mode that limits loading to tensors, primitive types and dictionaries, plus types you register. That mode is on by default in the current documentation, but do not rely on defaults, set it explicitly.
import torch
state = torch.load("pytorch_model.bin", map_location="cpu", weights_only=True)
- If the load fails because the file needs other types, stop and ask why. Do not widen the allowed types just to make it pass. A hostile file looks exactly like a file that needs unusual types.
- Save the tensors with the safetensors library. Check its README for the current save function and any rules about shared tensors.
- Reload the new file and compare tensor names, shapes and a few values against the loaded state.
- Compute SHA256 for the new file and store it with a note: converted from digest X, on date Y, by person Z.
- Destroy the sandbox.
What the new file proves
It proves the file contains tensors and a header, with no code path. It does not prove the weights are the ones the original publisher meant, and it does not prove they are free of poisoning. If the original source was untrusted, the converted file is still from an untrusted source with a nicer wrapper.
There is also a provenance question. The converted file now has you as its producer. If you share it internally, say so, and link back to the original so a later reviewer can trace it. A conversion is a derived artifact, and your records should show that.
When not to convert
If the source is unknown and the model is not essential, skip it. If a publisher already offers a safetensors version, compare that against the pickle through a reviewed route rather than converting yourself. And if you cannot sandbox the step, you are not ready to convert.
Quick check
Does weights only loading make conversion safe?
It narrows what the loader will accept, which helps a lot. Still use a sandbox, since a loader bug or a permissive setting would otherwise land on a machine with real access.
Should the converted file replace the original in my records?
Keep both. The original is the source, the converted file is a derived artifact, and the record should link them.
Safeguard scans repository dependencies and generates SBOMs, and policies and gates can block risky changes in pull requests. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
