In current PyTorch docs, torch.load defaults to weights_only=True, which restricts the unpickler to tensors, primitive types, dictionaries and types you explicitly allow. That makes loading a plain weights file much safer than a full pickle load. It is a restriction, not a trust decision, and the docs still say never to load data from an untrusted source.
Why torch.load needs a restriction at all
The PyTorch documentation states that torch.load uses an unpickler under the hood. Python's own pickle documentation says the module is not secure and that a crafted pickle can execute arbitrary code during unpickling. So a checkpoint saved the usual way is a pickle file, and loading it with a full unpickler means running whatever the file author put in it.
weights_only exists to narrow that. Instead of letting a file ask for any importable callable, the loader only rebuilds a short list of safe things.
What the flag allows
Per the torch.load page, with weights_only enabled the unpickler is limited to tensors, primitive types, dictionaries, and any types you register with add_safe_globals. That last part matters. If your checkpoint stores a custom class, loading will fail until you either save plain state dictionaries or deliberately allow that type.
Treat every allow-list entry as a decision. Adding a type means you accept whatever its construction does.
import torch
# Default in current docs: weights_only=True
state = torch.load("checkpoint.pt", map_location="cpu")
# Explicit opt out. The docs label this unsafe.
# state = torch.load("checkpoint.pt", weights_only=False)
What it does not do
It does not tell you the weights are good. A file can load cleanly and still hold a model that was fine-tuned to misbehave, or one you have no license to use. It checks the shape of the data, not the intent of the author.
It also does not help once someone passes weights_only=False. The docs mark that path as potentially unsafe, and plenty of older tutorials still show it. Search your own code and notebooks for that argument.
Finally, defaults depend on the version you run. The page I read documents the default as True for the version it covers. I did not confirm how earlier releases behaved, so check the version in your lockfile rather than assuming. Keep PyTorch itself patched, because a restricted loader is software too and can have bugs.
A sensible loading routine
- Prefer a format that is not a pickle at all when you can (see the safetensors post linked below).
- If you must load a PyTorch checkpoint, keep weights_only on and load on CPU first.
- Grep your repo for weights_only=False and justify each hit in review.
- Pin the exact file you reviewed by commit or hash, so the bytes cannot change under you.
- Only allow extra types through add_safe_globals after reading what they do.
Related reading: what safetensors protects against and pickle alternatives for ML checkpoints.
If your repositories load models through Python packages, Safeguard's SBOM and dependency scanning shows which versions of torch and related libraries you actually run, and policies and gates can fail a build on rules you set. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Is weights_only=True a guarantee a checkpoint is safe to use?
No. It restricts what the unpickler can rebuild. It says nothing about whether the weights come from someone you trust or behave as intended.
Why did my load fail after I turned weights_only on?
The file probably contains a type outside the allowed set, such as a custom class. Save plain state dictionaries, or allow the type with add_safe_globals only after reviewing it.
Sources
Last reviewed: 19 October 2026.
