A common model supply chain mistake is loading a downloaded weights file as if it were data. Pickle files can execute code when loaded, and published models carry weak provenance guarantees. Prefer a safe format such as safetensors, load only from sources you verify, and record where every model came from.
Why are weights risky at all?
Python's own documentation opens its pickle page with a warning: the module is not secure, and you should only unpickle data you trust, because malicious pickle data can execute arbitrary code during unpickling. It says to consider signing data with hmac if you must ensure it was not tampered with, and that safer formats such as JSON may suit untrusted data.
Hugging Face notes that pickle is the default format for PyTorch model weights, so the issue touches routine work, not edge cases. OWASP's guidance on LLM supply chain adds that "currently there are no strong provenance assurances in published models," and that model cards describe a model without verifying where it came from.
This post is defensive. It shows no payloads.
Mistake 1: treating a weights file like a dataset
A model file is closer to a program than to a spreadsheet. Python's docs say that by default unpickling imports any class or function found in the data. Hugging Face lists the dangers: importing a module can run code, builtin functions can be used for arbitrary execution, and object construction may call code.
Do instead: treat downloads as untrusted code. Load them in a sandbox with no credentials and no network until you have vetted them.
Mistake 2: trusting the scanner as a guarantee
Hugging Face runs antivirus and pickle import scans on files pushed to its Hub, and shows the list of imports next to each file. Its own page adds that this is not 100 percent foolproof and that users remain responsible for checking safety. Python's docs likewise warn that restricting what can be unpickled takes care.
Do instead: use scans as one signal. Add your own checks and prefer formats that cannot carry code.
Mistake 3: skipping safer formats
Safetensors is described by its documentation as a simple format for storing tensors safely, as opposed to pickle, and still fast. Hugging Face also lists TensorFlow and Flax checkpoints and alternatives such as MessagePack and Protobuf. A safe format reduces the code execution risk at load time. It does not prove the weights are honest. A tampered or poisoned model can still be stored in a safe container.
Do instead: require safe formats for new models, convert where you can, and keep separate controls for model behavior.
Mistake 4: trusting names and cards
An attacker who compromises a supplier account or imitates one can exploit the provenance gap, as OWASP notes. Hugging Face suggests relying on signed commits, and says a signature guarantees origin, not safety.
Do instead: pin to a specific revision, record its hash, and verify against the publisher through a second channel. Download from organizations you have a reason to trust.
Mistake 5: no inventory
Teams often cannot say which models run where, from which source and under which license. OWASP recommends a current, signed inventory of components, using AI BOMs or ML SBOMs, and cites CycloneDX as a starting point. CycloneDX can represent machine learning models as components. Inventory also helps with license tracking, since OWASP says to track licenses for datasets and models too.
Do instead: record model name, source, revision, hash, format, license, owner and where deployed.
What to do
- List every model in use, with source, revision and hash.
- Ban loading new pickle based weights outside a sandbox.
- Convert approved models to a safe format and note the conversion.
- Pin to revisions and verify hashes before deployment.
- Test third party models on your own use cases, since benchmarks may not reveal problems.
- Add models to your SBOM process, and review them on a schedule.
Treat any scanner, ours included, as one layer next to the habits above.
Quick check
Is safetensors enough to make a model trustworthy?
No. It addresses code execution during loading. It does not verify the origin or honesty of the weights, so you still need provenance checks and testing.
Can I trust a pickle file from a well known organization?
Trust the source more, but the format is still not safe by design. Verify revision and hash, and load in a restricted environment.
Sources
- Python documentation: pickle
- Hugging Face: Pickle scanning
- Hugging Face: Safetensors
- OWASP: LLM03:2025 Supply Chain
- CycloneDX: specification overview
Last reviewed: 18 October 2026.
