trust_remote_code=True lets a model repository on the Hub supply its own Python modeling files, and your machine will execute them. The Transformers docs default it to False and say to enable it only for repositories you trust and whose code you have read. Treat it like installing a package from that author.
What the flag does
Most models load through classes already shipped in the library. Some newer or custom architectures are not in the library yet, so the repository carries its own modeling files. The Transformers documentation describes the option as allowing custom models defined on the Hub in their own modeling files, and states plainly that it will execute code present on the Hub on your local machine.
The default is False. That is a safe default, and the right move is usually to leave it.
Why this is a supply chain issue
That code runs with your permissions: your files, your environment variables, your cloud credentials in the shell, your network. A weights file cannot do that when stored in a format without executable content, but a Python file can do anything Python can.
It is also a moving target. If you do not pin a revision, the code you reviewed last month may differ from the code that loads today. The docs describe revision as defaulting to main.
A review routine before enabling it
- Open the repository files and find the .py modeling and configuration files.
- Read them. Look for network calls, subprocess use, file writes outside the model folder, and anything that reads environment variables.
- Note the commit hash you reviewed.
- Load with that exact revision.
- Run the first load in a sandbox with no credentials and no outbound network, then compare behaviour.
from transformers import AutoModel
model = AutoModel.from_pretrained(
"org/model-name",
revision="FULL_COMMIT_HASH",
trust_remote_code=True, # only after reading that exact code
)
Options that avoid the flag
- Check whether a newer library release already supports the architecture natively.
- Ask whether the maintainers publish a variant that does not need custom code.
- Vendor the reviewed code into your own repository, so changes go through your pull requests.
Common mistakes
Copying a snippet from a model card that sets the flag without reading the code. Enabling it in a shared notebook image so everyone inherits it. Turning it on in a production service. If a service must load such a model, review and pin first and keep the service isolated.
Related: pin a Hugging Face model revision.
A quick example of what to look for
When reading a custom modeling file, ordinary code builds layers and defines a forward pass. That is expected. What should stop you is code that has no reason to exist in a model: downloading something at import time, running a shell command, reading credential files, or sending data to an address. If a file is long or hard to follow, that is also an answer. You are allowed to say the review cost is too high and choose a different model.
Quick check
Does a safetensors weights file make trust_remote_code safe?
No. The weights format and the modeling code are separate. The flag controls whether Python code from the repository runs.
Is the default value safe?
The default is False per the docs, so custom repository code does not run unless you opt in.
Sources
Last reviewed: 19 October 2026.
