Partly. Hugging Face's pickle guide says TensorFlow and Flax checkpoints are not affected by the pickle problem and can be loaded into PyTorch architectures using the from_tf and from_flax options. That avoids pickle for that path, but each format has its own checks and the guide lists it as one mitigation among several.
What the guide says
In its list of mitigation strategies for pickle, the Hub documentation includes: load files from users and organizations you trust, and rely on signed commits; load model weights from TF or Flax, since those checkpoints are not affected and can be loaded with from_tf or from_flax in from_pretrained; or use another serialization format, naming MsgPack, Protobuf, Cap'n'proto, Avro and safetensors.
So the guide does present TF and Flax loading as a way to circumvent the issue for PyTorch users who would otherwise load a pickle based file.
What it does not tell you
The guide does not say that a TF or Flax checkpoint is free of every risk. It says those checkpoints are not affected by the pickle issue. Other pages in this series cover that a TensorFlow SavedModel is itself a program graph, so loading it still deserves care. See is a TensorFlow SavedModel safe to load.
Also, the guide is a general explanation. Library behavior changes between versions, so check current documentation for the library and version you run before relying on any option.
When this route makes sense
| Situation | Reasonable choice |
|---|---|
| Repo offers safetensors weights | Use them. Simplest and data only |
| Repo offers only a pickle based PyTorch file and a TF or Flax checkpoint | Consider the TF or Flax route and test it |
| Repo offers only a pickle based file | Ask the owner for another format, or rebuild from training code |
| File came from an unknown uploader | Do not load it on a machine with real credentials |
Steps to try it
- Check the repo file list for safetensors, TF and Flax files.
- If only TF or Flax weights are available in addition to the pickle file, call the loader with the matching option and confirm that no pickle file is read. A network trace or a file access log helps you verify.
- Save the result as safetensors and keep that artifact, with the source hash recorded.
- Run your evaluation set to check the output matches expectations.
- Pin the source revision by full commit hash.
A note on trust
None of these routes tells you the weights are good. A model can behave badly without any code execution, for example through poisoned training. The format question is about what happens on load, and it is separate from what the model does later. See safetensors: what it protects against and what it does not.
Safeguard's dependency scanning and SBOM cover the libraries your inference code imports, and policies can gate changes. Try the free scan.
Quick check
Does from_tf make any model safe?
No. It avoids the pickle path for weights from a TF checkpoint. Other risks remain.
What is the simplest safe route for weights?
Use a data only format such as safetensors when the repo offers it.
Sources
Last reviewed: 19 October 2026.
