Treat it as running someone else's code. torch.hub.load downloads a GitHub repository and calls an entrypoint defined in its hubconf.py, which is Python. A trust_repo setting asks you to confirm repositories you have not trusted, but the call still runs repository code and, by default, follows a branch that can change.
How torch.hub works
PyTorch Hub is described in the PyTorch docs as a repository of pre-trained models for research reproducibility. A publisher adds a file called hubconf.py to a GitHub repository. That file defines entrypoints, which are Python functions that build a model. It can also declare a list of package names needed to load the model.
When you call the load function with a repository name and an entrypoint name, PyTorch fetches the repository and imports hubconf.py as a module. Importing a Python module runs its top-level code. Then it calls the entrypoint you named, which may fetch weights from a URL or read a checkpoint stored in the repo.
What the source code shows
These points come from the PyTorch source for the hub module and its docs, as of the main branch on 19 October 2026. Confirm them for the version you use.
| Behavior | Detail |
|---|---|
| Where code comes from | A GitHub repo in the form owner/name with an optional ref |
| Default ref | If you give none, it assumes the default branch is main if it exists, otherwise master |
| Trust prompt | A trust_repo argument: False prompts, True adds the repo to a trusted list and loads, check compares against the trusted list and falls back to prompting |
| Default for trust_repo | check |
| Weights loading helper | load_state_dict_from_url, with check_hash and weights_only both off by default |
The docs describe the trust parameter as helping to ensure users only run code from repositories they trust. It is a confirmation step, not an inspection of the code.
Why the defaults matter
A branch name is a moving target. If you load without a ref, you get whatever is on the default branch today. If the owner's account is compromised, or the repository is transferred or edited, tomorrow's load runs different code.
Passing True for trust skips the prompt and records the repo in a trusted list. In a script, that line can sit unnoticed for years. Also, the weights helper does not check a hash or restrict unpickling unless you ask it to.
How to use it with care
- Prefer another route. If the same weights are published as Safetensors with the architecture defined in a library you already review, use that. A separate post on this blog compares formats.
- Read hubconf.py and what it imports. It is usually short. Look at the entrypoint you will call, any downloads and any shell commands.
- Pin a tag, not a branch. The docs say the ref can be a tag or a branch, so choose a tag you reviewed. Better still, vendor the reviewed code into your own repository and load from a local directory.
- Use the local source option for production. The load function accepts a local source, so your service runs reviewed code from disk and never contacts GitHub.
- Turn on hash checking and restricted loading for weights if the helper offers them in your version, and verify the weights hash yourself.
- Run the first load in a sandbox with no credentials and no network beyond the repo and the weights host.
- Do not use True for trust in shared code without a comment saying who reviewed what and when.
torch.hub.load("./vendored/reviewed-repo", "entrypoint_name", source="local")
Find the uses in your code
Search for hub load calls across your repositories, notebooks and tutorials copied into internal docs.
grep -R "torch.hub.load" --include="*.py" --include="*.ipynb" .
Treat each match as a dependency on an external repository, and add it to your inventory.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how a code scan points at the exact line, which is how you would flag a hub load in review.
Quick check
Does the trust prompt inspect the repo for me?
No. It asks whether you trust the repository. The review is your job.
Is a pinned tag enough?
It beats a branch, but tags can be moved by the repo owner. Vendoring reviewed code gives you firmer control.
Where Safeguard fits
Safeguard offers dependency scanning and policies and gates in CI, so third-party code you pull in can be tracked and reviewed before release. A free scan is available.
Sources
- PyTorch hub module source, read 19 October 2026.
- PyTorch Hub documentation source, read 19 October 2026.
- PyTorch SECURITY.md, read 19 October 2026.
Last reviewed: 19 October 2026.
