When you pull a pre-trained model from a public hub, you are extending your trust boundary to whoever produced and hosts it. The weights themselves are data, but the surrounding artifacts, loaders, tokenizer configs, and serialization formats, can carry executable behavior.
Serialization is a trust decision
Some historical serialization formats can execute arbitrary code during deserialization. Prefer formats designed to hold tensors only, and avoid loading untrusted artifacts in formats that permit embedded code. If a format can run code on load, treat every file in that format as untrusted input.
Provenance and pinning
Record where an artifact came from, pin it by content hash, and re-verify on every fetch. A model that silently changes underneath you is indistinguishable from a compromised dependency. The same discipline you apply to third-party packages applies to third-party models.