Pickle-only uploads to Hugging Face doubled since 2024

Hugging Face is getting more pickle files, not fewer. In the second half of 2024, about one in seventeen people uploading model weights each month put up nothing but pickles. Since March it’s been about one in eight.

0%5%10%15%20%

Jul 24Jan 25Jul 25Jan 26Sep 26

The numbers

Month	Pickle only
Jul 24	6.3%
Aug 24	4.6%
Sep 24	5.1%
Oct 24	6.2%
Nov 24	6.2%
Dec 24	6.6%
Jan 25	6.3%
Feb 25	5.9%
Mar 25	7.3%
Apr 25	7%
May 25	8.3%
Jun 25	8.9%
Jul 25	9.1%
Aug 25	8.3%
Sep 25	9.1%
Oct 25	9.8%
Nov 25	11.4%
Dec 25	12.2%
Jan 26	11.3%
Feb 26	10.5%
Mar 26	13.4%
Apr 26	13.3%
May 26	15.1%
Jun 26	14%
Jul 26	13%
Aug 26	12.5%
Sep 26	12.3%

That matters because a pickle runs code when you load it, and safetensors doesn’t. Safetensors is what transformers writes, and the old pickles on the Hub are meant to be leftovers from before it caught on.

The numbers come from hub-stats, a daily dump of every public repo on the Hub with its file list, as of 21 October. I counted uploaders rather than repos, because one person can push a thousand repos in an afternoon. I also left out the Hugging Face RL course’s LunarLander and Huggy models, and Gensyn’s BlockAssist, which had over 9,000 people uploading pickled checkpoints from the same app last autumn. Leave those in and October 2025 reads 32%.

It peaked at 15% in May and has slipped every month since, which I’ll come back to.

Most of them load with weights_only

Since PyTorch 2.6, torch.load only unpickles tensors and a short list of harmless types unless you tell it otherwise. If these files load that way, the pickle doesn’t really matter.

I took one pickle-only repo with a PyTorch checkpoint (.pt, .pth or .ckpt) from each of 114 uploaders, picked at random from everything created between August and 21 October, and read the pickle inside the biggest checkpoint without running it. That’s just Python’s pickletools over a few ranged requests, so no downloading gigabytes and nothing gets executed. Then I checked everything it asks to import against torch’s list.

• Tensors only89
• Numpy values or training args10
• Other classes, configs or TorchScript7
• A whole YOLO model8

89 of them are a state_dict and maybe an epoch number, and load fine with weights_only on.

The other 25 won’t load. Ten of those are over something boring, like a numpy float for the best accuracy or the argparse settings from training. Here’s torch 2.14 on the numpy one, trimmed:

Weights only load failed. [...]
  (1) [...] Re-running `torch.load`
  with `weights_only` set to `False`
  will likely succeed, but it can
  result in arbitrary code execution.
  [...]
  (2) Alternatively, to load with
  `weights_only=True` please check
  the recommended steps in the
  following error message.
  WeightsUnpickler error: Unsupported
  global: GLOBAL
  numpy._core.multiarray.scalar was
  not an allowed global by default.
  [...]

The proper fix is option two, torch.serialization.add_safe_globals([...]) with the one numpy type it names. Option one is turning the protection off, it’s listed first and it says it’ll “likely succeed”. I’d guess that’s the one most people pick, but I’ve no way of checking that.

Another seven pickle a class from whatever they were trained with, like a LeRobot policy config, a DeepSpeed object or a model class from the uploader’s own code, so they won’t load at all without that code installed.

YOLO turns it off for you

The last eight are YOLO models pickled whole, Ultralytics classes and all, usually called best.pt. My favourite spots Xbox controllers. You’d load one with YOLO("best.pt"), and you never see torch’s error, because Ultralytics’ loader calls torch.load with weights_only=False unless you’ve asked otherwise. Since June there’s been an opt-in safe mode that loads them with weights_only=True and an allowlist of Ultralytics’ own classes:

ULTRALYTICS_SAFE_LOAD=1 python detect.py

Without it, a stranger’s best.pt runs whatever’s in it, on the latest torch and the latest Ultralytics.

None of the 114 files I read asks for anything nasty like os or eval. It’s people saving whatever was lying around at the end of training. But you can’t tell without looking inside, and most people look inside by loading it.

The newcomers brought them

Between July 2024 and July 2025, about 1,100 people a month uploaded a pickle-only model. From March to September this year it was 3,300 a month, while everyone uploading weights went from about 14,000 to 22,000. Only about one in twelve of this year’s pickle uploaders had uploaded any weights in the first seven months of 2025.

Four in five of their repos don’t say what library they’re for. Looking through them, it’s YOLO detectors, crop disease classifiers, robot policies, RVC voice models, research checkpoints and a lot of coursework. torch.save(model, "best.pt") and push.

They don’t seem to get many downloads, though that’s hard to pin down. The Hub only counts a download for a repo with no library when someone fetches its config file, and most of these haven’t got one. Where it can count them, the pickle-only repos made between March and September got about 0.2% of the last 30 days’ downloads of everything new from those months. This is the long tail, the stuff you land on from a search, a paper or a tutorial.

It’s slipped since May

May was 15.1%, then 14.0, 13.0, 12.5 and 12.3 in September. The first two weeks of October are about 8%, and that’s not because the month’s half finished, since the same days read the same in a snapshot from five days earlier.

Some of October is a wave of new people. Nearly 2,000 more a week than September’s average uploaded weights, most of it safetensors, under names like tiny-transformer and cnn-transformer that look a lot like a new term. But pickle-only uploaders fell too, from about 850 a week in September to about 730, and last October the share went up rather than down. I’m not sure what’s going on there.