Only if you trust where it came from. The scikit-learn documentation warns that loading pickle, joblib or cloudpickle files can execute arbitrary code, and says never to load one from an untrusted source. For files you did not produce, prefer a safer format such as skops or ONNX.
What the scikit-learn docs say
The model persistence page states that pickle has many documented security vulnerabilities by design and should only be used if the artifact comes from a trusted and verified source. It compares loading an untrusted pickle with running code from an untrusted source. Its summary table lists loading as able to execute arbitrary code for pickle, joblib and cloudpickle.
The Python documentation says the same about the pickle module: a malicious stream can execute arbitrary code during unpickling, and you should never unpickle data that could have come from an untrusted source or been tampered with.
Who is a "trusted source"?
| Source | Reasonable? |
|---|---|
| A file your own pipeline produced and stored in a bucket only it can write | Usually yes |
| A model downloaded from a public hub | Treat as untrusted |
| A file a vendor or contractor emailed | Treat as untrusted |
| A shared drive any analyst can write to | Doubtful: anyone who can write can plant code |
The last row is the one teams miss. A file you made yourself last month is only trustworthy if nobody could have replaced it since.
Safer options from the docs
- skops.io avoids pickle and loads only files whose types and function references are trusted by default or by you. The docs show a way to list untrusted types so you can review them before loading. Downsides: slower than pickle, fewer supported types, same training environment needed.
- ONNX is described as the most secure option when you only need predictions. Not every model converts, and you cannot rebuild the Python object. The docs also note that arbitrary computations can be represented in ONNX, so serve it in a sandboxed environment.
A practical policy
- Never load model files from outside your trust boundary with pickle based tools.
- Restrict write access to the model store, and log writes.
- Record metadata with each model: training source, dependency versions, score. The docs recommend this.
- Pin the same library versions in training and serving. The docs say loading across scikit-learn versions is unsupported and can give wrong results or crash the process.
- Prefer skops or ONNX for models that cross teams.
- Inspect, do not load. The Python docs say the pickletools module can examine a file without executing its bytecode.
For deeper reading see Python pickle and untrusted data.
Quick check
Is joblib safer than pickle?
No. The scikit-learn docs list joblib as able to execute arbitrary code on load, the same as pickle.
Can I check a pickle without running it?
You can inspect it with pickletools, which the Python docs say does not execute pickle bytecode. That is inspection, not a safety guarantee for loading.
Safeguard dependency scanning covers the Python libraries in your ML pipelines, with a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
