Yes. Python's pickle format can run code while it loads, so a poisoned pickle is an attack, not just bad data. Many PyTorch checkpoint files with a .pth extension are built on pickle. Treat any model file from an untrusted source like an executable, and prefer formats that cannot run code.
What does the Python documentation say?
The pickle module's own page opens its security discussion with a warning. It says the module is not secure, that you should only unpickle data you trust, and that it is possible to construct malicious pickle data which will execute arbitrary code during unpickling. It adds: never unpickle data that could have come from an untrusted source or that could have been tampered with.
The reason is how pickle works. It is not a plain data format. It is a small program that tells the loader which objects to build and which functions to call. A normal file calls harmless constructors. A poisoned one calls something else. The loader cannot tell the difference, because both are valid pickle.
Why do model files fall into this?
Machine learning frameworks needed a way to save complex Python objects. PyTorch's standard save routine uses pickle under the hood, and checkpoint files commonly carry the extension .pth or .pt. Download a checkpoint from a public hub, load it, and you have run whatever the uploader wrote into it. That is why "backdooring a .pth file" is a supply chain problem: the file looks like model weights, and the harm happens at load time, before any inference.
A second risk is separate: a model's weights can be tampered with to change behavior. That is a data integrity issue and needs provenance checks, not just a safe loader.
What is the safer format?
The safetensors project describes its format as a simple way of storing tensors safely, as opposed to pickle, while still being fast with zero-copy loading. It stores raw tensor data and a header, with no executable object graph. Loading cannot call arbitrary functions because the format has no way to ask for one.
PyTorch has also added loader options that restrict what can be unpickled. Check the current PyTorch documentation for the exact behavior in the version you use, since defaults have changed over releases. Python's documentation likewise describes restricting globals through the unpickler's find_class method, which lets you allow only a named list of types.
What does a constructed incident look like?
A data scientist finds a fine-tuned model on a public hub that promises better results on a benchmark. The repository contains one checkpoint file. She loads it in a notebook on a workstation that has cloud credentials in its environment. The load step runs the embedded code, which reads those credentials and sends them out. No scanner flagged the notebook, and the model works fine afterward. The only clue is an outbound connection at load time.
The defenses are boring and effective: load untrusted checkpoints only in a sandbox with no credentials, and prefer a format that cannot execute.
How to check or apply this
- Inventory where your team loads pickle-based files: checkpoints, cached objects, datasets, session stores.
- Prefer safetensors for model weights, and ask upstream projects to publish them.
- For pickle files you must load, use the restricted loading options in your framework and an allow list of classes.
- Open untrusted files in an isolated environment with no secrets and limited network access.
- Record the source, hash and version of every model you adopt, and verify before you load.
- Scan model files and the dependencies around them as part of your pipeline.
Dependency and model inventory is part of a software bill of materials. Safeguard's SCA inventory shows what your projects pull in, and the demo below walks through it.
See the full walkthrough at /demos/sca-dependency-inventory.
Quick check
Is a .pth file always dangerous?
Not always, but many use pickle, so you should assume it can run code unless you know the format and loader settings. Only load files from sources you trust.
Does safetensors remove all model supply chain risk?
No. It removes code execution at load time. The weights can still be tampered with, so verify the source and integrity of the model.
Sources
- Python documentation, pickle module
- Hugging Face, Safetensors documentation
- NIST AI 100-2 E2025, Adversarial Machine Learning taxonomy
PyTorch's current loader options were not fetched for this article. Check its documentation for your version.
Last reviewed: 18 October 2026.
