To publish a Hugging Face model with provenance, ship weights in safetensors, sign your commits, publish from CI with short-lived credentials instead of a stored token, and add a Sigstore signature over the model files. Consumers can then verify who published it and that no file changed.
What is provenance for a model?
Provenance answers two questions: who produced these files, and are they the files that were produced. For software packages, signed build records help. For models, the same idea applies to weights, tokenizer files and config. The Sigstore model-transparency project describes its aim as verifiable claims about the integrity and provenance of models, so users can check for themselves instead of trusting the trainer.
Why does the file format matter?
Pickle, the default format for PyTorch weights, can run code when loaded. Hugging Face's own documentation says there are dangerous arbitrary code execution attacks possible when you load a pickle file, and suggests loading models from trusted users and organizations, relying on signed commits, or using safetensors. Safetensors is described as a simple format for storing tensors safely, as opposed to pickle, while staying fast.
If you publish pickled weights, every consumer inherits that risk. Publishing safetensors removes the load-time code execution path and is the simplest provenance step you can take.
How do you sign commits and protect your account?
The Hub supports signing commits with GPG. Hugging Face notes this does not guarantee a file is safe, but it does guarantee the origin of the file. It also lists two-factor authentication among its security features. Turn both on for every account that can push to your model repositories, and use organization roles so fewer people can write.
How should CI publish without a stored token?
For tokens, Hugging Face recommends one access token per app or usage, so you can revoke one without breaking the rest, and fine-grained tokens for production, since impact is reduced if one leaks.
For CI, the documentation goes further. If only your pipeline needs access, you can avoid storing a token as a CI secret. Trusted Publishers exchange your CI provider's OpenID Connect identity token for a short-lived Hub token at the start of each run, scoped to the repository for publishing. That removes the long-lived secret most likely to leak.
How do you add a signature?
The Sigstore model-transparency project provides a model signing CLI and API. It signs a model directory and produces a Sigstore bundle that holds the verification material and a statement listing each file path with its digest. With Sigstore, signing uses a short-lived certificate from an OIDC login, and signing events go to an append-only transparency log. Verification checks the signature, then recomputes file hashes and compares them with the signed ones. Verifiers must supply the identity and provider that signed.
Publish the bundle next to the model and say in the model card which identity signs your releases. Check the project's current documentation for exact commands, since the tool is evolving.
Constructed example: a team's release workflow trains a classifier, exports safetensors, signs the output directory using the workflow's OIDC identity, and pushes the files, signature bundle and a model card line naming the expected workflow identity. A consumer's script refuses to load a model whose signature identity differs.
What to do
- Convert released weights to safetensors and stop shipping pickle files.
- Enable two-factor authentication and commit signing for maintainers.
- Replace stored write tokens in CI with trusted publishing, or use fine-grained tokens with one token per pipeline.
- Sign model directories with Sigstore in the release job and publish the bundle.
- State the expected signer identity in the model card.
- Add a verify step to any pipeline that downloads your model.
- Keep a record of the training data, code commit and base model used for each release. Safeguard's platform can track AI components in a bill of materials alongside software dependencies.
Quick check
Does a signed model mean it is safe to use?
No. A signature shows origin and integrity. It does not show the model is free of bias, backdoors or poor quality, so evaluation still matters.
Why avoid stored tokens in CI?
A stored token can be copied from logs or a compromised runner and reused. Trusted Publishers issue short-lived tokens per run instead.
Sources
- Pickle scanning, Hugging Face Hub documentation
- User access tokens, Hugging Face Hub documentation
- Safetensors documentation
- Hub security overview
- sigstore/model-transparency, GitHub
Last reviewed: 18 October 2026.
