An antivirus scan looks for known malicious files. A pickle import scan lists what a pickle would import and call when loaded, using pickletools to read the file without running it. They answer different questions, neither is foolproof, and a model pipeline benefits from both plus format rules.
What the Hub documents
Hugging Face describes a scanner that checks files pushed to the Hub with two kinds of scan: ClamAV and pickle imports. Its own text states that ClamAV covers a good amount of dangerous files but does not cover pickle exploits. That is why a second scan exists.
The pickle import scan extracts the list of imports referenced in a pickle file whenever a pytorch_model.bin or other pickled file is uploaded. The Hub displays the list next to the file and highlights imports that look suspicious. It reads the file with pickletools.genops, which allows it to read instructions without executing potentially dangerous code. The page adds that this reveals whether unpickling will REDUCE, meaning call, a risky function brought in by a GLOBAL instruction.
A side by side
| Question | Antivirus scan | Pickle import scan |
|---|---|---|
| What does it look at | File content against known malware signatures | The import list inside a pickle |
| Good at | Known malicious files and binaries | Spotting a pickle that imports exec, eval or similar |
| Weak at | Pickle exploits, per the Hub's own text | Anything not a pickle; imports judged only by a list |
| Output | Clean or detected | A list of imports, with suspicious ones flagged |
What the Hub says about its own limits
The documentation includes a disclaimer that the pickle scan is not 100 percent foolproof, that the safe and unsafe import lists are maintained on a best effort basis, and that it is the user's responsibility to check whether something is safe. It also says the Hub is not actively auditing Python packages for safety. Take that at face value. A clean badge is a data point, not a decision.
What to run yourself
- Format rule first. Prefer data only formats such as safetensors for weights from outside your team. A rule that avoids pickle removes the question.
- Import listing. For any pickle you must keep, list its imports with pickletools on an isolated machine and compare against an allowlist you maintain.
- Antivirus pass. Run a signature scan on downloaded artifacts as one layer among several.
- Hash check. Record the file hash and compare on every use.
- Rescan. Signature and import lists change, so rescan stored files on a schedule.
Why layers beat a single badge
Each method has a blind spot. The Hub's text itself explains why an antivirus alone is insufficient for pickle. Layering a format rule, an import check and a signature scan means an attacker has to get past different kinds of checks.
Safeguard's dependency scanning, SBOM and policy gates cover the libraries and packages your project depends on, and continuous rescans keep the picture current. See a free scan.
Quick check
Does a clean antivirus result mean a pickle is safe?
No. The Hub's documentation says ClamAV does not cover pickle exploits.
Does a clean pickle import scan prove safety?
No. The Hub calls its scan not foolproof and best effort.
Sources
Last reviewed: 19 October 2026.
