Not every model file is equally risky to open. Pickle based files such as many .bin and .pt checkpoints can run code on load. TensorFlow SavedModel graphs are treated as code. Keras files can embed lambda code. Safetensors holds only tensors. Use the table below to decide how much review a file needs.
The table
| File type | Typical extension | Can it run code on load? | What the sources say |
|---|---|---|---|
| PyTorch checkpoint | .bin, .pt, .pth | Yes, if loaded as a plain pickle | Hugging Face calls pickle the default format for PyTorch weights and warns of arbitrary code execution |
| TensorFlow SavedModel | saved_model folder | Treat as yes | TensorFlow says untrusted models are equivalent to untrusted code |
| Keras v3 | .keras | Only if unsafe lambda loading is enabled | Keras safe_mode defaults to True and blocks unsafe lambda deserialization |
| Keras legacy | .h5 | Treat with care | The TensorFlow guide lists HDF5 as a legacy format |
| ONNX | .onnx plus data files | Not a pickle, but paths matter | External data uses relative file paths |
| Safetensors | .safetensors | No code in the format | Header plus raw bytes, no pickle |
I describe the .h5 row as "treat with care" because the pages I read call it a legacy format and describe Keras safe mode for the v3 format only. They do not give a per format verdict for HDF5, so verify that for your version before relying on it.
How to use the table
- List the files in a model repo before loading anything.
- For each extension, find its row and decide the handling: trusted source only, sandbox, or normal.
- If a repo offers safetensors, prefer it and skip the rest when you can.
- For anything marked yes or treat as yes, load only from sources you have decided to trust, inside a sandbox with no secrets and no network.
Files that are not weights
A repository also holds files that are not weight files. Custom model code is the one to watch. In the Transformers library, loading a custom model needs the trust_remote_code option, and the docs advise taking extra precaution and loading from a specific revision so you do not load code that has changed. A weights file can be fine while a Python file beside it is the real risk.
Config and tokenizer files are data, but your loader reads them, so keep them under the same pinned revision as the weights.
Common mistakes
- Judging a repo by its weights file alone and never opening the other files.
- Assuming a hub scan result replaces review. The Hub's own page says its pickle scan is not foolproof and that the user is responsible for checking.
- Switching Keras safe mode off to make a load error go away.
- Loading a file on a laptop that holds cloud credentials.
Quick check
Is a .bin file always a pickle?
No, the extension is only a hint. Many .bin weight files from PyTorch are pickle based, but you should check how your loader reads it, not rely on the name.
Is safetensors enough on its own?
It removes the code execution path in the weights file. You still need to check code files in the repo, the license, the source and the behavior of the model.
Safeguard scans repository dependencies and generates SBOMs, and policies and gates can block risky changes in pull requests. Try a free scan at gold.safeguard.sh/scan.
Sources
- Hugging Face Hub pickle scanning
- TensorFlow SECURITY.md
- TensorFlow Keras save and load tutorial
- Keras model saving and loading API
- ONNX external data
- safetensors repository README
- Transformers loading models guide
Last reviewed: 19 October 2026.
