A model file is a bundle of numbers plus the instructions for reading them. The security question is whether reading the file can run code, so the glossary below marks each term by what it contains and whether loading it can execute anything. Definitions are general, so check your own tools.
Core terms
| Term | Plain meaning | Can loading run code |
|---|---|---|
| Weights | The learned numbers that make a model behave as it does | Depends on the file format |
| Checkpoint | A saved snapshot of weights, sometimes with training state | Depends on the file format |
| Pickle | Python's serialization format; the default for PyTorch weights, per the Hugging Face pickle guide | Yes, it can, by design |
| Safetensors | A simple format for tensors | Designed as data only |
| GGUF | A single file format used by local inference runtimes | Designed as data, but check your runtime |
| ONNX | An interchange format for model graphs | Standard operators are runtime provided; custom operators need extra native code |
| Adapter | A small add on that changes a base model's behavior | Same as its file format |
| Tokenizer | The component that turns text into numbers | Usually data files, but review what your loader reads |
| Config | A settings file describing the model | Data, but custom code references deserve a look |
| Model card | The README with metadata and description | Documentation, but not a guarantee |
| Revision | A version of a repo, such as a branch, tag or commit | Not a file |
Why format matters more than the model
The Hugging Face pickle guide explains that a pickle is a stack of opcodes, and some opcodes import and call functions, which is how arbitrary code runs on load. A format that holds only tensor data has no such opcodes. So two files with identical numbers can carry very different risk, based only on how they are stored.
Terms about where a model came from
Provenance is the record of who made a file and how it reached you. Pinning means fixing a dependency to an exact version, for models the full commit hash. Signed commit means a commit cryptographically tied to a key; the Hub documentation says this does not guarantee a file is safe, only its origin. Gated model means access requires accepting terms or approval, which is an access control and not a safety review.
Terms about runtime
Inference is running the model to get outputs. Quantization shrinks the numbers to save memory, producing a different file with its own provenance. Fine tuning continues training from a base model, producing new weights. Remote code is Python code in a model repo that a loader may execute when explicitly allowed. See what does trust_remote_code do in Transformers.
How to use the glossary in a review
- Ask which file formats the model ships in.
- For each, check the "can loading run code" column and apply the stricter rule.
- Ask where each file came from and which revision was approved.
- Record answers in your model inventory.
For a deeper table of extensions see model file extensions and what each one can do.
Quick check
Is a bigger model riskier to load than a smaller one?
Not by size alone. The file format and the loader code decide whether loading can run code.
Does a signed commit mean the file is safe?
No. The Hub documentation says it shows origin, not safety.
Safeguard's SBOM and dependency scanning can list the packages around a model, and asset discovery helps find where models are used. A free scan is a first step.
Sources
- Hugging Face Hub documentation, Pickle Scanning
- Hugging Face Hub documentation, Signing commits with GPG
- Hugging Face Hub documentation, Model Cards
Last reviewed: 19 October 2026.
