What is a model serialization attack?

As a quick refresher, a model serialization attack is an exploit in which a machine learning model file or data stream carries hidden executable code that runs automatically when the model is deserialized (loaded). The most common vector is Python’s pickle format, which can embed arbitrary code through the __reduce__ method, so that simply loading a malicious model grants the attacker remote code execution on the host. This is why the format a model ships in is a critical security decision, not just an engineering one.

The format war is over. Safetensors won.

Starting with good news: Safetensors has become the standard for secure model storage and its adoption is no longer marginal: more than a million model repositories on the Hub now carry safetensors weights. At the time I wrote the first article, “switch to safetensors” was a relatively exotic advice, whereas today it is closer to the path of least resistance.

Safetensors works by doing dramatically less than pickle. It stores raw tensor bytes behind a JSON header (plus optional string metadata — never code) and executes nothing during loading. There is no __reduce__ to hijack and no arbitrary Python to run - the entire class of attack that made pickle dangerous simply cannot be expressed in the format.

However, while the format war is over, the supply-chain war just started.

Model serialization attack trends in 2026

Safetensors removed code execution from the model file. The attack surface, however, moved into the pipelines: from the inference services to the format conversion frameworks and the surrounding infrastructure.

CVE-2026-25874 is a notable example that affected Hugging Face’s own LeRobot: its asynchronous inference pipeline exposed an unauthenticated gRPC channel passing payloads straight into pickle.loads(), hence allowing malicious actors to achieve remote-code-execution: a crafted __reduce__ runs the attacker’s command on the GPU host the moment it is deserialized.

Another interesting attack vector also affecting Hugging Face is HiddenLayer’s Silent Sabotage (2024), which showcased how Hugging Face’s conversion service dedicated to converting insecure machine learning models could be hijacked.

Both these examples intentionally involve Hugging Face: if the very company that created safetensors to solve exactly the curse of model serialization attacks still falls victim to the problem it largely helped solve, then clearly the threat is not over for anyone.

The new attack pattern in 2026 is “safe format, unsafe usage”. Safetensors secures the container, not the contents, the pipeline, or the code that reads it. The industry solved a format problem and inherited a supply-chain problem.

Next in this series: a walkthrough of the main tools and solutions to mitigate the new model serialization attack patterns in 2026.

If you found this useful, the awesome-MLSecOps repository is the most comprehensive open resource on MLSecOps and AI security - curated tools, attack vectors, papers, and learning roadmaps. And to get these deep-dives in your inbox, subscribe to The MLSecOps Hacker.

The MLSecOps Hacker Newsletter

Safetensors Won. Model Serialization Attacks…