TL;DR: Pickle is a serialization format whose loader executes construction steps embedded in the file, so loading an untrusted pickle checkpoint runs the author's code with your permissions. Safetensors stores only a JSON header and raw tensor bytes, so loading cannot execute code. It does not fix backdoored or poisoned weights, custom model code loaded with
trust_remote_code, malicious tokenizers, configs or notebooks shipped alongside, loader parser bugs, or tampering without hash and signature checks.
How to approach it
Explain the pickle mechanism, then safetensors' design, then spend as long on the limits as on the fix. Close with the intake process you would actually run.
A strong answer
Pickle checkpoint
Embedded construction steps
any callable
torch.load runs them
with your permissions
Author's code executes
Outcome, unsafe: Code execution
Never load untrusted pickles
Safetensors
JSON header + raw tensors
no code
Loading reads bytes
nothing executes
Still: backdoored weights, remote code
Outcome, safe: Safe to load
Provenance still matters
Why pickle is dangerous. Pickle encodes a small program for the unpickler, and objects can specify callables to invoke during reconstruction. A checkpoint saved with traditional torch.save is a pickle archive; loading it with an unrestricted loader executes whatever the uploader embedded. Malicious models have been found on public hubs. PyTorch 2.6 changed torch.load to default to weights_only=True, which restricts unpickling to tensors and allowlisted types, but older code, other libraries and explicit opt-outs remain common.
What safetensors fixes. Its structure is an 8-byte header length, a JSON header (tensor names, dtypes, shapes, offsets) and raw bytes. A loader parses numbers; nothing in the file selects code to run. It also memory-maps efficiently, which helped adoption.
What it does not fix.
| Remaining risk | Why | Control |
|---|---|---|
| Backdoors and poisoning | Behaviour lives in the weights | Provenance, evaluation and red teaming; detection is limited |
trust_remote_code | Executes Python from the model repository | Review and pin the commit, or avoid |
| Companion files | Tokenizers, configs, scripts, notebooks | Inspect and allowlist what is loaded |
| Parser bugs | Any parser of untrusted bytes can be exploited | Patch loaders; isolate |
| Tampering | A modified safetensors file is still valid | Hashes and signatures against trusted references |
| Licence and data issues | Not a format concern | AI-BOM and review |
Intake process. Prefer safetensors; convert legacy pickles once in an isolated sandbox; enforce weights_only=True; disallow remote code by default; pin model revisions by commit or hash; verify signatures where publishers provide them; scan for pickle opcodes and unexpected files; load and evaluate new models in an environment without credentials or egress; record the model in an AI-BOM.
What interviewers probe next
- "How do model scanners detect malicious pickles?" They parse the pickle opcodes without executing them and flag imports and calls of dangerous functions; useful, but evasions exist, so they are a layer, not a guarantee.
- "Is GGUF safe?" It is a data format, but its parsers have had vulnerabilities; treat loaders as attack surface and keep them patched.
- "Where would you enforce this in a company?" A model registry or proxy as the only approved source, with checks at ingestion, plus policy that blocks direct hub downloads in production.
What if?
What if · interview follow-ups
Hold your answer as the constraints change
A data scientist downloads a model checkpoint from a public hub and loads it with torch.load on a laptop that has cloud credentials and source code access.
Start here
Why is loading a pickle checkpoint risky?
What does the pickle loader do with instructions in the file?
Pickle is a serialisation format whose loader executes construction steps embedded in the file. A malicious checkpoint can run arbitrary code with the user's permissions when loaded, before any weights are used: stealing credentials, installing malware or altering code.
Carry it forwardLoading untrusted pickle runs the author's code.
Weak answerThinking a model file is just numbers.
Constraint changes
What does safetensors change?
Can a format with only data trigger code?
Safetensors stores only a JSON header and raw tensor bytes, so loading cannot execute code. Prefer it for every model you can, and convert pickle-based files in a sandbox if you need them.
Carry it forwardSafetensors removes code execution at load time.
Weak answerAssuming safetensors also makes the model trustworthy.
Constraint changes
What risks remain with safetensors?
What else in the repository might run or mislead?
Backdoored or poisoned weights, custom model code loaded with trust_remote_code, malicious tokenizers, configs or notebooks shipped alongside, bugs in loader parsers, and tampering if hashes and signatures are not checked. The format fixes one risk, not all.
Carry it forwardSafe formats fix load-time code, not behaviour or companions.
Weak answerApproving a model because it is in safetensors.
Constraint changes
What if the data scientist must use a pickle-only model?
Where could untrusted code run without harm?
Load or convert it in an isolated environment with no credentials, no network and a throwaway filesystem, scan it first, then store the converted safetensors version in an internal registry by hash. Never load it on a laptop with access to production.
Carry it forwardConvert untrusted pickles in a sandbox.
Weak answerLoading 'just once' on a work laptop.
Constraint changes
What organisational control prevents this happening again?
Where should models enter the organisation?
Route all models through an internal registry that accepts safe formats only, pins revisions and hashes, scans and records provenance. Block direct downloads from public hubs in production and discourage them on developer machines with credentials.
Carry it forwardOne intake point for models.
Weak answerRelying on individual judgment each time.
Now defend it
What policy would you set for model files?
Safe formats such as safetensors by default; pickle-based files only converted in an isolated sandbox without credentials or network; no trust_remote_code without review; scanning and provenance checks at a single intake registry pinned by hash; companion files reviewed; and behavioural evaluation, since safe formats do not reveal backdoors.
How it's scored
Weak: Says "use safetensors" and stops.
Hire: Explains pickle execution, safetensors' data-only design, and at least backdoors and remote code as limits.
Strong Hire: Covers the full limits table, weights_only defaults, scanning trade-offs, isolated conversion, and a centralised intake process.
Common mistakes
- Believing a safe format means a safe model.
- Loading unreviewed models with
trust_remote_code=True. - Converting pickles on a machine with credentials.