A Verified badge on a Hugging Face commit means it was signed with a GPG key whose public half is registered on the author's Hub account. That supports a claim about who made the commit. It does not show the model is safe, and the Hub documentation says exactly that.
Why git needs signing
The Hub's documentation explains that git controls who can push, but does not authenticate commit authors. You can commit as any name and email you like. Signing closes that gap: the commit carries a cryptographic signature that the Hub can check against a key the author registered.
The three states
Per the Hub docs, a commit can show one of three signing statuses.
- Verified: signed, and the signature verified.
- Unverified: signed, but the signature could not be verified.
- No signing status: the commit is not signed.
For a commit to show as Verified, the author uploads the signing public key to their account, and the key email must match a verified account email.
What it tells you
If you already know and trust an author, a Verified commit increases confidence that the change came from them and not from someone who pushed with a copied name. The Hub's pickle documentation recommends loading models from users and organisations you trust and relying on signed commits.
What it does not tell you
The same page is explicit: signing does not guarantee your file is safe, only the origin. A trusted author can publish a bad file by accident. A stolen signing key would produce commits that still verify. And signing says nothing about weights, behaviour or licence.
Two more practical limits. Signing is optional, so some models will have no signed commits at all, and requiring it everywhere would exclude them. And verification tells you which account key signed, not that the account holder is who they claim in the real world.
How to use it
- For models from a publisher you rely on, check that recent commits show Verified.
- Record the commit hash you reviewed and pin it.
- If a previously verified publisher suddenly pushes unsigned commits, treat it as a reason to look closer.
- Combine with format choice, scans and testing.
Related: pin a Hugging Face model revision and what signed commits prove in general.
An example decision
Suppose you depend on a model from a research lab. Its last ten commits show Verified, and today a new commit that replaces the weights shows no signing status. That change of pattern is worth a message to the maintainers before you update your pin. You are not accusing anyone. You are using a free signal to decide whether to look closer. Without the signing history, you would have no baseline to notice the change against.
Quick check
Should I only use models with Verified commits?
That would exclude any model without signed commits, since signing is optional. Use it as one signal for publishers you rely on, not as a universal gate.
Does Verified mean the weights were scanned?
No. It only concerns who signed the commit.
Sources
- Signing commits with GPG, Hugging Face Hub documentation
- Pickle Scanning, Hugging Face Hub documentation
Last reviewed: 19 October 2026.
