Why are pickle model files risky, and how do you check provenance?

Pickle is a Python format that can execute code when it is loaded, and it is the default format for PyTorch weights. Loading a model from an untrusted source can therefore run an attacker's code. Prefer safetensors, trust only verifiable publishers, and keep a record of each model's origin.

What is a pickle file?

A pickle is a stack of instructions that Python replays when you load it. The Hugging Face documentation explains that this lets a file reference functions and classes and have them run at load time. The Python documentation is blunt: the module is not secure, only unpickle data you trust, and malicious pickle data can execute arbitrary code during unpickling.

Model weights are often distributed this way. Hugging Face notes that pickle is the default format for PyTorch weights, so downloading a checkpoint and loading it is, in effect, running someone else's program.

Why does this matter for supply chains?

OWASP lists the problem under two risks. Under data and model poisoning (LLM04) it notes that models shared through repositories can carry malware, such as malicious pickle files that run code on load. Under supply chain (LLM03) it says models are binary black boxes, published models lack strong provenance guarantees, and a model card documents a model without verifying where it came from. It also describes lookalike repositories and compromised supplier accounts.

So there are two separate questions. Will loading this file run code? And is this the model I think it is?

Do scanners solve it?

They help, with limits. The Hugging Face hub scans pushed files, including a pickle import scan that lists what a pickled file imports and highlights suspicious items. Their own documentation says this is not foolproof and that the safe and unsafe import lists are maintained as effort allows. The Python documentation also warns that restricting which globals can be loaded is error prone.

Treat a clean scan as one signal. It is not proof of safety.

What is safetensors?

Safetensors is a simple format for storing tensors that avoids pickle's code execution path. It stores tensor data and metadata, with zero copy loading. Because the format holds only tensors, loading it does not run code the way unpickling does. It addresses the code execution problem. It does not tell you whether the weights were tampered with or poisoned, so provenance still matters.

What to do

1. Prefer safetensors, or another format that holds only data, for any weights you download.
2. If you must load a pickle based checkpoint, do it only from a publisher you know, and do it in a sandbox with no credentials and no network.
3. Check the publisher. Compare the organization name and repository spelling against official announcements, since lookalike repositories exist.
4. Verify integrity. Record file hashes and, where the source supports it, use signed commits or signatures. Hugging Face notes signed commits prove origin, not safety.
5. Pin to a specific revision and mirror approved models internally, so a changed upstream file cannot reach production unannounced.
6. Record each model in an AI bill of materials with source, revision, hash, format and license, so you can answer "which services use this model" when a problem is reported.
7. Test behavior as well as code safety. OWASP recommends red teaming and monitoring because a backdoor can stay dormant until a trigger appears.

Where Safeguard fits

Treat models as dependencies. A dependency inventory that includes the Python packages your inference code pulls in, plus an internal record of approved models, gives your team one place to look. Safeguard's reachability analysis and compliance automation apply to the code side of this. The model weights themselves need the controls above.

Quick check

Sources

• Hugging Face, Pickle Scanning
• Hugging Face, Safetensors
• Python documentation, pickle
• OWASP, LLM04:2025 Data and Model Poisoning
• OWASP, LLM03:2025 Supply Chain

Last reviewed: 18 October 2026.