Answers
Loading a PyTorch pickle file from an untrusted source can run an attacker's code on your machine, so treat downloaded models like downloaded code. Safer formats, scanning, signing and an inventory of what you run reduce the risk without removing it.
Yes, if its file format can run code when it is loaded. Hugging Face says pickle, the default format for PyTorch weights, allows arbitrary code execution on load, and that pickle is not the only exploitable format: Keras Lambda layers can achieve the same. Load models only from users and organizations you trust, and treat model files as untrusted code until scanned.
A pickle exploit is a crafted pickle file that runs attacker code when it is loaded. The Python documentation says malicious pickle data can execute arbitrary code during unpickling and tells readers never to unpickle data from an untrusted source. Hugging Face explains the mechanism: the GLOBAL and STACK_GLOBAL opcodes import a function such as exec, and REDUCE calls it.
Safetensors avoids the code execution that pickle allows, but a safe format does not make the weights trustworthy. Hugging Face describes it as a format for storing tensors safely, as opposed to pickle, and a Trail of Bits audit found no critical flaw leading to arbitrary code execution. OWASP still warns that pre-trained models can hide backdoors, so verify where the model came from too.
Scan before you load, then again after training and before deployment. picklescan scans a Hugging Face model by its ID with the --huggingface flag, ModelScan reads H5, pickle and SavedModel files, and Fickling analyzes pickle files statically and can block imports outside an allowlist at load time. ModelScan's README says ad hoc scanning is not sufficient for production MLOps, so automate these scans in your pipeline.
Model signing attaches a cryptographic signature to a model so you can verify who published it and that its files have not changed. Sigstore's model-transparency project writes a Sigstore bundle when signing; verification checks the signature, then recomputes the file hashes and compares them with the signed values. Signing proves origin and integrity, not safety, as Hugging Face says about GPG-signed commits.
An AI-BOM, also called an ML-BOM, is an inventory of the models, datasets and dependencies in an AI system, with their provenance. CycloneDX describes its ML-BOM as covering models, datasets and their dependencies, including dataset provenance and training methods. OWASP calls AI BOMs an emerging area, suggests starting with CycloneDX, and lists an up-to-date component inventory among its supply chain mitigations.
LLM03:2025 Supply Chain is the main entry, and LLM04:2025 Data and Model Poisoning is closely related. LLM03 covers vulnerable pre-trained models, weak provenance and malicious adapters, and recommends third-party integrity checks with signing and file hashes. LLM04 warns that shared models can carry malware through malicious pickling and that backdoors can stay dormant until a specific trigger.
Some do, but a registry scan is a safety net, not a verdict. Hugging Face runs ClamAV and a pickle import scan on uploaded files and says the pickle scan is not 100% foolproof, and Protect AI's Guardian scans public repositories on the Hub. JFrog Xray scans models from Hugging Face and says a Hugging Face Dangerous label and an Xray malicious finding are separate determinations.