Only if you trust where the file came from. scikit-learn's documentation says pickle, and joblib and cloudpickle by extension, have documented security vulnerabilities by design and should only be used with files from a trusted, verified source. Treat loading a model file like running a program.
Why loading can run code
A pickle file is not just data. It is a set of instructions that rebuild Python objects when loaded, and those instructions can call functions. A file crafted by someone else can make that rebuild do something harmful. The scikit-learn page compares loading an untrusted pickle with executing code from an untrusted source. For the general case, see Python pickle with untrusted data.
The alternatives scikit-learn names
| Format | What it gives you | Cost |
|---|---|---|
| ONNX | No Python object is loaded, so no pickle path | Not every model converts, custom parts need work |
| skops | Returns the Python object without allowing arbitrary code by default | Slower, fewer types than pickle |
| pickle or joblib | Fast, widest support | Trusted sources only |
For skops, the documentation shows a step where you list untrusted types in the file and load only if you trust everything in it. The page also notes that ONNX is not automatically safe, since it can represent arbitrary computation, and recommends serving such models in a sandboxed environment.
The version rule that surprises people
The documentation says there is no supported way to load a model trained with a different scikit-learn version. It may load but is described as entirely unsupported and inadvisable, and results may be wrong or the process may crash. It recommends pinning scikit-learn, NumPy, SciPy and related packages the same in training and production, and using containers to freeze the environment.
That is a supply chain point as well as a reliability point: a pinned, scanned environment is easier to reason about than a loose one.
A checklist before you load a model
- Know who produced the file and how it reached you.
- Compare a checksum with one published through a separate channel.
- Load it in a container with no secrets and no network.
- Prefer a format that does not execute code when you have the choice.
- Save metadata with your own models: training data reference, code, library versions and score.
Try it yourself
Click through it at your own pace, or open it full screen. See how reachability separates vulnerable code that runs from code that never does.
Quick check
Is joblib safer than pickle?
No. The documentation says the same limits apply to joblib and cloudpickle.
Can I load a model from a newer scikit-learn version?
It is described as unsupported and inadvisable. Retrain or pin the same version.
Safeguard's reachability analysis helps show which vulnerable code your project actually calls, and a free scan covers dependencies.
Sources
Last reviewed: 19 October 2026.
