pickle
A built-in Python standard library module for object serialization. It converts Python objects into byte streams for persistent storage and supports most built-in Python types. It serves as the most fundamental serialization tool in the Python ecosystem.
Core Facts
Timeline (last 90 days)
Model weight files may be implanted with malicious code, for example executing arbitrary commands through pickle deserialization vulnerabilities.
If a model internally contains large numpy arrays (as is common with scikit-learn models), joblib has advantages over pickle in both speed and reliability.
pickle implements serialization by converting Python objects into a byte stream, a process called pickling, with the reverse recovery called unpickling.
pickle is a Python built-in standard library used to serialize most Python objects, but it is slow when handling large numpy arrays and is unsuitable for big data scenarios.
A large number of existing models are still distributed in pickle format (.pkl, .pt, .bin), making static scanning before ingestion (e.g., with the picklescan tool) a necessary line of defense.
For platforms such as Hugging Face, attacks have been historically documented in which arbitrary code execution is triggered during model loading via malicious pickle files.
Prioritizing safetensors over pickle format when loading models can eliminate the risk of deserialization code execution at the source.
Hugging Face supports using the safetensors format as a replacement for the pickle format.
PyTorch的.pt/.pth文件和许多框架的checkpoint依赖pickle进行序列化存储
应使用安全的序列化格式如safetensors而非pickle，并对拉取的模型进行完整性校验
3 more timeline events
All Facts (13)
Python pickle格式在反序列化时可以执行任意代码，攻击者可以在模型文件中嵌入恶意代码
65%UnverifiedModel weight files may be implanted with malicious code, for example executing arbitrary commands through pickle deserialization vulnerabilities.
50%UnverifiedIf a model internally contains large numpy arrays (as is common with scikit-learn models), joblib has advantages over pickle in both speed and reliability.
50%Unverifiedpickle is a Python built-in standard library used to serialize most Python objects, but it is slow when handling large numpy arrays and is unsuitable for big data scenarios.
50%Unverifiedpickle implements serialization by converting Python objects into a byte stream, a process called pickling, with the reverse recovery called unpickling.
50%UnverifiedA large number of existing models are still distributed in pickle format (.pkl, .pt, .bin), making static scanning before ingestion (e.g., with the picklescan tool) a necessary line of defense.
50%UnverifiedFor platforms such as Hugging Face, attacks have been historically documented in which arbitrary code execution is triggered during model loading via malicious pickle files.
50%UnverifiedHugging Face supports using the safetensors format as a replacement for the pickle format.
50%UnverifiedPrioritizing safetensors over pickle format when loading models can eliminate the risk of deserialization code execution at the source.
50%UnverifiedPyTorch的.pt/.pth文件和许多框架的checkpoint依赖pickle进行序列化存储
50%Unverified应使用安全的序列化格式如safetensors而非pickle，并对拉取的模型进行完整性校验
50%Unverifiedsafetensors等安全格式正在推广作为pickle格式的替代，但大量存量模型仍使用pickle格式
50%Unverified深度学习社区长期以pickle格式分享模型权重（.pt、.pkl文件），safetensors等安全格式正在推广以替代
50%