What does a malicious Hugging Face model look like, and what do you do?

A malicious Hugging Face model usually carries code in a pickle weight file that runs when you load it. Warning signs include pickled files with unexpected imports, odd uploaders and custom loading code. If you already loaded one, treat the machine as compromised: isolate it, rotate credentials it could reach, and report the repository.

How can a model run code?

Pickle is a stack of instructions read in order. Hugging Face's documentation explains that it lets users run Python code at deserialization time, by importing modules and calling functions. The risky pieces are import instructions that pull in functions such as eval or exec, and the call instruction that executes them. Constructors can also run when objects are rebuilt.

So loading a pickled model is closer to running a program than opening a data file. That is why the docs say not to unpickle data from untrusted sources.

What do the Hub's scans catch?

Hugging Face says every file under 2 GB in a repository goes through a malware scanner on each commit, with an infected or ok badge shown, and a warning for users if a file is scanned as unsafe. Its pickle scan lists the imports referenced in a pickled file by reading the opcodes without executing them, and highlights suspicious ones.

The documentation is candid about limits. The pickle scan is not 100 percent foolproof, the safe and unsafe import lists are maintained on a best-effort basis, and checking safety remains the user's responsibility. A clean badge means "nothing known found", not "reviewed".

What are the warning signs?

• A model repository with pickled weights where safetensors would be normal.
• Imports in the Hub's file view that have nothing to do with tensors, such as system, subprocess, network or code execution modules.
• Repository code or a custom loading script that must be trusted to run, when the architecture is standard.
• A new account, copied model card, a name close to a well-known model, and a download count that does not match its age.
• A README asking you to run a setup command or enable remote code.
• A recent commit that changed the weights but not the model card or version.

None of these is proof. They tell you which files to open in a sandbox first.

How do you inspect safely?

Read the list of imports without loading the file. The standard library's pickletools can disassemble a pickle without executing it. Do this in a disposable container with no network and no credentials, and never call the real loader to see what happens.

Prefer safetensors, and load only from users and organizations you trust, ideally with signed commits, as Hugging Face suggests.

What if you already loaded it?

Constructed example: a notebook server loaded a downloaded checkpoint last week, and an import you do not recognise shows up afterwards.

1. Isolate the host from the network and stop the notebook process.
2. Preserve the model file, shell history and logs before wiping anything.
3. List the credentials the process could reach: environment variables, cloud role credentials, SSH keys, Hub tokens, and rotate them.
4. If a Hub token may have leaked, delete or refresh it from your settings. Hugging Face documents a public revoke endpoint for found tokens.
5. Rebuild the host from a clean image.
6. Report the repository to Hugging Face at security@huggingface.co, the contact its security page lists.
7. Find every other system that downloaded the same file.

What to do before it happens

1. Convert to or require safetensors in your pipelines.
2. Pin model revisions by commit hash instead of floating branches.
3. Allow downloads only from an approved list of organizations.
4. Run loading in a sandbox with no secrets mounted.
5. Keep an inventory of models in use. Safeguard can record AI components alongside software dependencies and scan the repositories that load them.

Quick check

Sources

• Pickle scanning, Hugging Face Hub documentation
• Malware scanning, Hugging Face Hub documentation
• User access tokens, Hugging Face Hub documentation
• Hub security overview

Last reviewed: 18 October 2026.