Security: Remote Code, Pickles and Tokens

Treat model repos like dependencies

Downloading a model means running someone else's artefacts, so apply the same caution as with any dependency. Pickle-based weight files (pytorch_model.bin, .pt, .pkl) can execute arbitrary code when loaded, because Python's pickle format can encode function calls. The safetensors format stores only tensors and metadata, so it cannot run code; prefer repos that provide .safetensors files and pass use_safetensors=True to refuse anything else. Second, trust_remote_code=True lets a repo run its own Python modelling code on your machine. Some new architectures need it, but enable it only for repos you trust and pin a revision commit hash so the code cannot change under you. Third, protect access tokens: use fine-grained or read-only tokens, keep them in environment variables or secret stores, and rotate any token that leaks. Finally, check licences and gated-model terms, and remember that a model can memorise and repeat sensitive training data, so never fine-tune on personal data you are not allowed to process.

A cautious loading pattern

Pin the exact commit, require safetensors and keep remote code off unless you have reviewed it.

import os
from transformers import AutoModelForCausalLM

model = AutoModelForCausalLM.from_pretrained(
    "some-org/some-model",
    revision="<commit-sha-you-reviewed>",   # immutable
    use_safetensors=True,                   # refuse pickle weights
    trust_remote_code=False,                # the default; keep it that way
    token=os.environ.get("HF_TOKEN"),       # never a literal string
)

Read the code before trusting it

If a model genuinely needs trust_remote_code=True, open the repo's .py files on the Hub and read them first. A pinned commit plus a quick review is the difference between using a dependency and blindly running a stranger's script.

Quick check: Why is safetensors considered safer than pickle-based `.bin` weight files?

• It encrypts the weights
• It only stores tensors and metadata, so loading cannot execute arbitrary code
• It is always smaller on disk
• It requires a Hub token to open