Setting trust_remote_code=True lets the Transformers library run Python code that ships inside a model repository, instead of only its own built-in model code. That is needed for custom architectures, but it means loading the model also runs the author's code on your machine.
Why a custom model needs it
The Transformers documentation explains that a custom model builds on the library's configuration and modeling classes, but the modeling code is not from Transformers. Because it is not, you must pass trust_remote_code=True to load it. Without the flag, the library will not run that code.
The documentation says to take extra precaution with custom models. It notes that the Hub scans every repository for malware, and still advises care to avoid inadvertently executing malicious code. A scan lowers risk but is not a guarantee.
Weights and code are different risks
| Risk | What it is | Mitigation |
|---|---|---|
| Weight file format | Older PyTorch weights use pickle, which is documented as insecure | Prefer safetensors files |
| Repository code | Python in the repo runs when you set the flag | Read it, pin the revision |
The loading guide says the library loads safetensors weights when they are available, and calls them more secure and faster than pickle based weights. That helps with the first row only. The flag is about the second.
Pin a revision
The documentation gives a second layer of safety: load the custom model from a specific revision, so you do not pick up model code that has changed since you reviewed it. You copy the commit hash from the model's commit history and pass it as the revision.
model = AutoModelForImageClassification.from_pretrained(
"org/model-name", trust_remote_code=True, revision="<full commit hash>"
)
Related reading: pin a Hugging Face model revision to a commit hash.
What to look for when you read the code
Open the modeling and configuration files and search for network calls, subprocess use, file writes outside the model folder, reads of environment variables, and any import you do not recognise. Check that the repository's requirements do not pull in unusual packages. A custom architecture should need numerical libraries, not shell access.
A decision guide
- Does the architecture exist in the library already? Then you do not need the flag, so leave it off.
- If you do need it, read the modeling and configuration files before the first load.
- Pin the commit you read.
- Run first loads in a container with no credentials and limited network.
- Re-read the diff before moving to a newer revision.
Quick check
Does a clean Hub scan mean the model code is safe?
No. The documentation still says to take care to avoid executing malicious code.
Does safetensors remove the need for care with remote code?
No. It addresses the weight file format. Repository code is a separate risk.
Safeguard's MCP Guardrail and policies are aimed at agent tool use, and its SAST code scanning can look at Python you vendor in. A free scan is open to try.
Sources
Last reviewed: 19 October 2026.
