Loading a pickle model file can execute code, so treat it like running a program from the internet. Safetensors was built to store tensors safely, and GGUF stores tensors plus metadata for local runtimes. Prefer those two for downloaded weights, and still check where a file came from.
Why pickle is the risky one
Hugging Face's documentation explains that pickle is a stack of instructions, and that unpickling can import modules and call functions such as eval or exec. It says this is why most docs tell you not to unpickle data from untrusted sources. It also notes pickle is the default format for PyTorch model weights, so many older checkpoints use it.
The Hub scans pushed files for pickle imports and displays the list next to each file. The same page is clear that this is not foolproof and that checking safety remains the user's responsibility. A scan helps, but it does not replace a decision about whether to trust the publisher.
The earlier post on what to do instead of unpickling untrusted data covers the general pattern.
Safetensors
The safetensors documentation describes it as a simple format for storing tensors safely, as opposed to pickle, that is still fast through zero-copy loading. The point of the design is to load tensors without pickle's route to code execution.
That removes the code execution route at the file format level. It does not tell you whether the model is any good, or whether the model's own configuration and custom code files are safe. Some model repositories ship extra Python files that a loader may offer to run. Do not enable remote code for a repository you have not reviewed.
GGUF
The Hugging Face GGUF page describes it as a binary format optimized for quick loading and saving, designed for use with GGML and other executors. Unlike tensor only formats such as safetensors, GGUF encodes both the tensors and a standardized set of metadata.
It is the usual format for llama.cpp and tools built on it. The format holds data, not Python objects. Parsers can still have bugs, so keep your runtime up to date. Past advisories exist for local inference engines, and the llama.cpp advisory write up is one example on this site.
A checklist before you load a file
- Prefer safetensors or GGUF over pickle based checkpoints.
- Download from the publisher's official account, and check the account name carefully for lookalikes.
- Compare the hash with one published by the maintainer, if they publish one.
- Keep remote code execution options off in your loader.
- Run unfamiliar models in a container or a separate user account with no access to your home directory.
- Keep the runtime patched.
For sandboxing ideas see open weight model sandboxing patterns.
Safeguard's SBOM and dependency scanning can cover the Python packages your model loading code depends on, and the free scan at https://gold.safeguard.sh/scan is a quick way to start.
Quick check
Is a safetensors file always safe?
The format avoids code execution on load. The repository around it can still contain other files, and the model can still produce bad output. Check the source as well as the format.
Can I convert a pickle checkpoint to safetensors?
Conversion requires loading the pickle once, which is the risky step. Do that inside a sandbox, or use a conversion that was already done by a publisher you trust.
Sources
Last reviewed: 19 October 2026.
