A model card tells you what a model is for, how it was trained and evaluated, and where it is weak. It does not prove the file you downloaded is the one described. OWASP says model cards offer no guarantees on origin, so pair them with integrity checks and a short list of security questions.
What is a model card?
The idea comes from a 2018 paper by Mitchell and colleagues, "Model Cards for Model Reporting." They propose short documents that accompany trained models, giving benchmarked evaluation across conditions and stating the context a model is intended for, so people avoid using it where it is poorly suited.
Hugging Face makes the idea concrete. On its Hub the model card is the README of a model repository, with YAML metadata at the top. Its documentation says a card should describe the model, intended uses and limitations including bias and ethical considerations, training parameters, datasets and evaluation results. Metadata can also name the license and the base model, and mark a model as a fine-tune, adapter, quantized version or merge.
What does a card give a security reviewer?
Quite a lot, if it is filled in.
- Lineage. The base model field shows what the model derives from, so you can check that parent too.
- License. OWASP's supply chain entry lists licensing as a risk, since software and dataset licenses carry different legal terms.
- Intended use and limits. This tells you whether your use case is one the authors tested. A model used outside its stated context is a design risk.
- Training data. Named datasets let you ask about poisoning and consent.
- Evaluation. Results show what was measured, and by implication what was not.
For general-purpose models, the EU AI Act asks providers to document capabilities and limitations for downstream integrators (Article 53), so cards for those models may grow to carry more of this.
What can a card not tell you?
The OWASP LLM03 entry on supply chain says it directly: there are currently no strong provenance assurances in published models, and model cards and associated documentation provide information users rely on but no guarantee of the model's origin. An attacker who compromises a supplier account, or publishes a lookalike repository, can ship a convincing card with a tampered model.
OWASP adds that models are binary black boxes, and static inspection offers little security assurance, so a vulnerable or backdoored model can pass the safety evaluations a repository shows.
A card is also not a vulnerability disclosure. It does not list known security flaws, patch status or a contact for reporting.
What about the file format?
Check the weights format. Hugging Face's documentation says pickle, the default for PyTorch weights, can allow arbitrary code execution when a file is loaded. It suggests loading models from trusted users and organizations, relying on signed commits, and notes that its Hub displays the imports in pickled files. Safetensors was designed as a format for storing tensors safely, as opposed to pickle.
What to do
- Read the card for lineage, license, intended use, training data and evaluation. Note anything missing.
- Verify the source: the publisher account, signed commits and the exact repository, not a lookalike.
- Record the model's hash and version in your inventory so you can tell if it changes.
- Prefer formats that do not execute code on load, and scan files you cannot avoid in an isolated environment.
- Check the base model and any adapters, since a malicious adapter can compromise a sound base, as OWASP notes for LoRA.
- Ask the supplier for a security contact, a vulnerability reporting route and an update policy.
- Add the model to your software bill of materials, and re-review when the card or the weights change.
What should a good security disclosure include?
Beyond the card: who maintains the model and for how long, how to report a flaw, how updates are signed, what data the operator keeps from your prompts, and what terms govern that data. OWASP flags unclear terms and privacy policies as a risk, because sensitive data can end up in training.
Quick check
Is a model card proof a model is safe?
No. It is documentation, not verification. OWASP notes cards offer no guarantee of origin, so check the source, format and integrity of the files yourself.
Why does the weights format matter for security?
Per Hugging Face, loading a pickle file can execute arbitrary code, and pickle is the default format for PyTorch weights. Safetensors stores tensors without that behavior.
Sources
- Mitchell et al., Model Cards for Model Reporting
- Hugging Face Hub documentation, Model Cards
- Hugging Face Hub documentation, Pickle Scanning
- Hugging Face, Safetensors documentation
- OWASP Gen AI Security Project, LLM03:2025 Supply Chain
- AI Act Explorer, Article 53
Last reviewed: 18 October 2026.
