You can read a pickle file's instructions without running them by using Python's pickletools module. Disassemble the file, then look for GLOBAL, STACK_GLOBAL and REDUCE opcodes. They show which functions the file wants to import and call. Never open the file with pickle.load to see what is inside.
Why disassembling is safe and loading is not
A pickle is a sequence of opcodes that the unpickler executes in order. Hugging Face's pickle documentation describes it as a stack of instructions, and notes that pickletools can read those instructions without executing any code. Python's own docs say the same: python -m pickletools is the tool for examining pickles from untrusted sources, and the python -m pickle command line should not be used for that purpose.
That difference is the whole technique. One path reads the file as data. The other obeys it.
Step by step
Work in a throwaway container or VM with no network and no credentials, even though disassembly should not run code. Defense in depth costs little here.
python -m pickletools suspicious_model.pkl | head -200
For a PyTorch .bin or .pt file saved in the zip layout, the pickle is a member inside the archive. List the archive first, then extract the data.pkl member into your scratch folder and disassemble that.
unzip -l pytorch_model.bin
unzip -o pytorch_model.bin '*/data.pkl' -d scratch
python -m pickletools scratch/*/data.pkl
Which opcodes to look at
The Hugging Face page names three instructions that pose the threat: STACK_GLOBAL, GLOBAL and REDUCE. The GLOBAL family tells the unpickler to import something. REDUCE tells it to call a callable with arguments. Together they can import a builtin such as exec or eval and then call it with a string.
A harmless model checkpoint usually imports a short, boring list: tensor rebuild helpers, ordered dictionaries, storage types. The Hub itself lists the imports found in pickled files and highlights suspicious ones.
Red flags in the import list:
- Anything from builtins such as eval, exec or compile.
- Modules for running processes, networking or file operations.
- Imports unrelated to machine learning at all.
Limits of this approach
Hugging Face is direct about it: its own import scan is not foolproof, and the safe and unsafe lists are maintained on a best-effort basis. Your manual review has the same limits. Obfuscated payloads, unusual import paths and very large files make human review slow and error prone.
Treat disassembly as triage. If it finds something odd, reject the file. If it finds nothing odd, you have reduced risk but not removed it, so prefer a format that cannot carry code, or load in a sandbox.
For a broader view, see pickle alternatives for ML checkpoints.
Quick check
Is it safe to run pickle.load once, just to look inside?
No. Loading is exactly what triggers any embedded code. Use pickletools to disassemble the file instead.
Does a clean import list prove the file is safe?
No. It is a useful signal, but review can miss things, and the Hub's own scan is described as not foolproof.
Sources
Last reviewed: 19 October 2026.
