Use the allow_patterns and ignore_patterns options of snapshot_download to fetch only the files you want, such as safetensors weights and JSON configs, and skip pickle based files. Pair it with a pinned revision, and run a dry run first to see exactly what would be downloaded.
Why filter at download time
A model repository often holds the same weights in several formats. The Hugging Face download guide shows an example listing for one repo that includes a pickle based pytorch_model.bin, TensorFlow and Flax files, ONNX files, TFLite files and a model.safetensors file. If you only need one, downloading the rest wastes bandwidth and brings files onto disk that you will never review.
Filtering also shrinks what you have to trust. A pickle file you never downloaded cannot be loaded by accident.
The three controls
| Option | What it does |
|---|---|
| revision | Selects a branch, tag, pull request reference or full commit hash |
| allow_patterns | Keep only files matching these wildcard patterns |
| ignore_patterns | Skip files matching these patterns |
The docs note that patterns are standard wildcards, based on fnmatch, and can be combined. They also note that a commit hash must be the full length hash, not a 7 character short one.
Steps
- Preview first. The command line tool supports a dry run that lists which files would be downloaded and their sizes, without fetching them.
hf download org/model-name --dry-run
-
Choose a revision. Use a full commit hash for anything you plan to ship.
-
Download only what you need.
from huggingface_hub import snapshot_download
snapshot_download(
repo_id="org/model-name",
revision="FULL_COMMIT_HASH",
allow_patterns=["*.safetensors", "*.json", "*.md"],
ignore_patterns=["*.bin", "*.pt", "*.pth", "*.h5", "*.msgpack"],
)
- List the resulting folder and confirm no unexpected files came with it.
- Hash the files and record the repo, revision and digests.
Things filtering does not fix
If a repository ships custom Python code, a configuration file can still point at it. Filtering weights does not remove code files you allowed with a broad pattern such as star dot py, so keep patterns narrow. Check the pinned revision for tokenizer and config files that your loader reads.
Some repositories only publish weights in a pickle format. In that case a filter leaves you with nothing, and you have to decide whether to load that file in a sandbox, ask the publisher for a safer format, or choose another model.
Make it a habit
Put the download call in a script under version control rather than typing it ad hoc. Reviewers can then see the repo, revision and patterns in a pull request. For pinning guidance, see pin model revisions like a lockfile.
Quick check
Does skipping .bin files make a model safe?
It removes one common pickle path. You still need to check the publisher, the license, any code files and the weights themselves.
Why use a full commit hash instead of main?
A branch can move. A full commit hash points at one exact snapshot, so what you tested is what you deploy.
Safeguard scans repository dependencies and generates SBOMs, and policies and gates can block risky changes in pull requests. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
