Fickling is an open source decompiler, static analyzer and bytecode rewriter for Python pickle files. Teams use it to inspect a pickle without trusting it and, optionally, to hook pickle loading so files with imports outside an allowlist are blocked. It reduces risk but does not replace choosing safer formats.
What the project says it is
The project README describes fickling as a decompiler, static analyzer and bytecode rewriter for Python pickle serializations. It says you can use it to detect, analyze, reverse engineer, or even create malicious pickle or pickle based files, including PyTorch files. It works as a library and as a command line tool, and the README says it was tested on Python 3.9 through 3.13.
The "create" part is worth noticing. The same tool that helps defenders is documented as able to build proofs of concept, and the Hugging Face pickle guide uses it that way to show how a payload is injected. Run it only in isolated environments.
The safe ML environment hook
The README describes a way to secure AI and ML codebases: activate a safe ML environment early, before importing torch, numpy or other libraries that use pickle. Fickling then hooks the pickle module and verifies imports made when loading a model. It checks imports against an allowlist of imports from ML libraries it considers safe and blocks files containing other imports.
If a model needs an import that is not on the list, you can add it with an also_allow argument. The README warns that you must make sure manually added imports are actually safe and cannot let attackers run arbitrary code.
There are also two ways to enforce checks on every pickle load: a global setting, or a context manager that checks only inside the block. Failing a check raises an UnsafeFileError.
Where it fits in a workflow
| Stage | Use |
|---|---|
| Intake review | Decompile or analyze a pickle on an isolated machine before anyone loads it |
| Pipeline gate | Run the analyzer on new pickle files and fail the build on findings |
| Runtime guard | Activate the hook so a surprise import raises an error |
Limits to keep in mind
An allowlist is a judgement about code. Someone has to own it, review additions and remove entries. A permissive list defeats the purpose.
A static analyzer can be evaded by a determined attacker, which is why defense in depth matters: also prefer safetensors for weights from outside your team, isolate loading, and give the process minimal credentials. The Hub's own documentation says that building a custom unpickler is not a complete answer either.
A small adoption plan
- Inventory the pickle files you load. See how to find model files in repos and artifact stores.
- Convert what you can to safetensors, from files you trust.
- For the rest, run the analyzer in CI and record results next to the file hash.
- Turn on the runtime hook in a test environment first, and record what it blocks.
- Assign an owner for the allowlist.
Safeguard's policies and gates, dependency scanning and SBOM cover the packages in your pipeline, including the libraries you add for tools like this. A free scan is a quick first look.
Quick check
Does fickling make loading any pickle safe?
No. It reduces risk with analysis and an allowlist, but safer formats remain the better choice.
Can fickling create malicious pickles too?
Its README says it can be used to create them, so use it only in isolated environments.
Sources
Last reviewed: 19 October 2026.
