Not unless you trust the source. TensorFlow's own security guidance says models are programs, so running an untrusted model is the same as running untrusted code. Treat a SavedModel from an unknown publisher like an executable, and load it in a sandbox.
What the maintainers say
The TensorFlow security policy states that models are encoded as computation graphs, and that using untrusted models or graphs is equivalent to running untrusted code. If you must run one, it advises executing it inside a sandbox. For serialized graphs, including SavedModel files, you should assume the TensorFlow process effectively executes arbitrary code.
The save and load tutorial repeats the caution in a short note: TensorFlow models are code, and it is important to be careful with untrusted code.
This matters because many people assume a model is just data. In TensorFlow's case the file can describe operations that run on your machine.
How the save formats differ
The Keras guide lists three ways to save a whole model, plus a weights only option.
| Format | Status in the guide | What it stores |
|---|---|---|
| .keras | Recommended | Object configs for the architecture |
| SavedModel | Legacy, still supported | The execution graph |
| HDF5 (.h5) | Legacy, still supported | Object configs for the architecture |
| Checkpoint | Weights only | Variable values, not architecture |
The guide notes that the key difference is that .keras and HDF5 use object configs to describe the architecture, while SavedModel saves the execution graph. An execution graph is exactly the kind of content the security policy warns about.
Checkpoints are not free of risk
A weights only checkpoint sounds harmless. The security policy points out that an untrusted checkpoint carries untrusted variable values, and that a malicious one could redirect filesystem or network operations that rely on those values. Smaller risk than a full graph, but not zero.
A safe handling routine
- Prefer files from publishers you can name and contact.
- Pin the exact version and record its digest so you can tell if it changed.
- Load unknown models in a sandbox with no network and no access to secrets.
- Prefer the recommended .keras format for models you produce, and avoid shipping legacy formats to others without need.
- Keep TensorFlow itself updated, since the loader is part of your attack surface.
- Add the model file to your inventory with source, version and owner.
If a model must be served in production, review what the graph contains before it reaches a host that holds credentials.
Quick check
Is a weights only checkpoint safe to load from anyone?
Safer than a full graph, but not safe by default. TensorFlow's guidance says untrusted checkpoints carry untrusted values that could influence file or network operations.
Should I convert SavedModel files to another format to be safe?
Converting does not remove the risk, because converting means loading the file first. Do the conversion in a sandbox, and only for sources you have decided to trust.
Safeguard scans repository dependencies and generates SBOMs, which helps you see which ML libraries and versions you run. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
