An unfamiliar model download can be dangerous before a single inference runs. Review executable code, loading formats and dependencies.
The file extension is not a security guarantee
Model packages may contain numeric weights, architecture definitions, tokenizer files, scripts, configuration files and custom loading instructions. Certain serialization formats or loader options can permit code execution while deserializing objects. Other packages may invite a user to run setup scripts or install unpinned dependencies. Treat every downloaded package as a software supply-chain artifact, not merely a harmless dataset.
What a secure intake reviews
Record the publisher, repository, commit or release ID, expected file hashes, artifact types, declared license and dependencies. Use available safer serialization paths, disable arbitrary custom code unless justified and inspect scripts before execution. Pin dependency versions and restrict build-time and runtime permissions. A popular download count does not establish the integrity of a particular release.
Isolation is not optional for unknown sources
Evaluate untrusted candidates in controlled sandboxes with no production credentials, restricted network egress, read-only inputs where practical and limited filesystem access. Keep sensitive datasets outside the test environment. Watch for unexpected subprocesses or outbound connections. A container by itself is not an unconditional security boundary; isolation quality depends on configuration and host controls.
The update trap
A previously trusted repository may add a new script or dependency. Cache and verify approved artifact hashes rather than automatically following a moving branch. Re-scan changed components, review provenance and sign off before promotion. The same approach applies to adapters, quantized variants and community-contributed plugins.
A worked procurement decision
A research group finds two purportedly identical model checkpoints. One is from a recognized publisher with documented checksums and loading instructions; the other is an anonymous mirror requesting an unusual installer. Until the second source is verified and isolated, it should not enter the organization’s trusted environment. Performance claims cannot compensate for an unverified software supply chain.
Privacy and license questions are separate
A secure file may still have commercial-use restrictions, unclear training provenance or unacceptable behavior. Track security assessment, usage rights and model quality as separate approval columns. Do not infer that ‘open weights’ means no obligations or that a safe tokenizer makes the entire package trustworthy.
Boundaries of the source
OWASP lists supply-chain risk among its 2025 LLM application categories; NIST covers adversarial AI threats more broadly. Specific exploitability depends on loader implementation and package contents. This article does not claim that every serialization format or model hub is vulnerable.
Sources & Further Reading
Primary Scope and applicability vary by task and jurisdiction. This article is educational guidance, not legal, medical or financial advice.