Model supply chain: how do you handle pickle files and weights provenance?

Handle model files like executables. Prefer formats that cannot run code on load, never unpickle a file you do not trust, pin the exact revision you downloaded, verify a signature where one exists, and record where every set of weights came from.

Why are pickle files a problem?

Python's documentation puts it bluntly: the pickle module is not secure, and it is possible to construct malicious pickle data that executes arbitrary code during unpickling. It tells you to never unpickle data that could have come from an untrusted source or been tampered with.

This matters for ML because pickle is widely used for model weights. Hugging Face's documentation notes it is the default format for PyTorch model weights, and explains that unpickling can import and call functions. The risky instructions are the ones that import modules and then call them with arguments.

OWASP's data and model poisoning page makes the same point from the risk side: models from shared repositories can carry malware, such as malicious pickling.

What does repository scanning cover?

Hub-style scanners help but have limits. Hugging Face says it runs antivirus scans and a pickle import scan that lists the imports a pickled file references and highlights suspicious ones. Its own page adds a disclaimer: this is not 100 percent foolproof, and users remain responsible for checking safety. It also says the lists behind the scan are maintained as a matter of effort, not guarantee.

So a clean badge lowers risk. It does not clear a file.

What are your options for loading weights?

The same documentation lists mitigations. Load models from users and organizations you trust. Use signed commits to confirm origin, understanding that a signature proves who published a file, not that it is safe. Use other formats, including safetensors, a simple format for storing tensors that is designed as an alternative to pickle.

If you must load a pickle, Python's docs show how to restrict what can be imported by overriding find_class on an Unpickler and allowing only a small named set. The docs still advise considering alternatives if security is a concern. The PyTorch docs for torch.load describe a weights_only option, but we could not retrieve that page for this review, so read the version matching your install before relying on it.

How do you verify where weights came from?

The Sigstore model-transparency project provides a model_signing package. Its repository describes signing and verifying ML models using Sigstore keyless signing, public keys or certificates, or hardware devices. Verification checks the signature, then recomputes file hashes and compares them with the signed values. If both pass, the files have not changed since signing, and the signature can be tied to an identity you trust.

That gives you integrity and a named signer. It does not tell you whether the training data was clean. For that, record data and model lineage using a format such as CycloneDX or an ML-BOM, as OWASP suggests.

A hands-on checklist

1. Inventory every model file your systems load, including ones pulled at startup by libraries.
2. For each, note format, source, publisher and revision.
3. Pin the revision or commit hash. Do not load "latest" in production.
4. Prefer safetensors or another non-executable format. Convert in an isolated environment, then store the converted file.
5. For pickle files, disassemble and inspect imports without loading them, using the standard library tooling Hugging Face describes.
6. Never unpickle in a process that holds production credentials.
7. Verify signatures where the publisher provides them.
8. Keep a copy in your own artifact store and load from there.
9. Add the model to your SBOM or ML-BOM with a source link.

What to do

1. Run the inventory above this week.
2. Block loading of pickled weights from unpinned sources in production code.
3. Set up a quarantine environment with no network and no secrets for inspecting new files.
4. Move to safetensors for models you control.
5. Add provenance fields to your model registry.
6. Re-check models when a publisher reports a problem.

Quick check

Sources

• Python docs: pickle
• Hugging Face Hub: Pickle Scanning
• Hugging Face: safetensors
• Sigstore model-transparency
• OWASP GenAI: LLM04:2025 Data and Model Poisoning

Last reviewed: 18 October 2026.