# Security: Remote Code, Pickles and Tokens — Hugging Face Transformers

Source: https://www.skillbyai.com/en/hugging-face/hf-security

> Load third-party models safely and protect tokens, licences and user data.

## Treat model repos like dependencies

Downloading a model means running someone else's artefacts, so apply the same caution as with any dependency. **Pickle-based** weight files (`pytorch_model.bin`, `.pt`, `.pkl`) can execute arbitrary code when loaded, because Python's pickle format can encode function calls. The **safetensors** format stores only tensors and metadata, so it cannot run code; prefer repos that provide `.safetensors` files and pass `use_safetensors=True` to refuse anything else. Second, `trust_remote_code=True` lets a repo run its **own Python modelling code** on your machine. Some new architectures need it, but enable it only for repos you trust and pin a `revision` commit hash so the code cannot change under you. Third, protect **access tokens**: use fine-grained or read-only tokens, keep them in environment variables or secret stores, and rotate any token that leaks. Finally, check **licences** and gated-model terms, and remember that a model can memorise and repeat sensitive training data, so never fine-tune on personal data you are not allowed to process.

## A cautious loading pattern

Pin the exact commit, require safetensors and keep remote code off unless you have reviewed it.

```python
import os
from transformers import AutoModelForCausalLM

model = AutoModelForCausalLM.from_pretrained(
    "some-org/some-model",
    revision="<commit-sha-you-reviewed>",   # immutable
    use_safetensors=True,                   # refuse pickle weights
    trust_remote_code=False,                # the default; keep it that way
    token=os.environ.get("HF_TOKEN"),       # never a literal string
)
```

## Read the code before trusting it

If a model genuinely needs `trust_remote_code=True`, open the repo's `.py` files on the Hub and read them first. A pinned commit plus a quick review is the difference between using a dependency and blindly running a stranger's script.

**Quiz:** Why is safetensors considered safer than pickle-based `.bin` weight files?

- [ ] It encrypts the weights
- [x] It only stores tensors and metadata, so loading cannot execute arbitrary code
- [ ] It is always smaller on disk
- [ ] It requires a Hub token to open

*Answer:* It only stores tensors and metadata, so loading cannot execute arbitrary code. Pickle can encode code that runs on load. safetensors is a simple tensor format with no code execution path.