Where Models Come From, and Downloading Them Safely

7.1 The main sources, and what each one is

Source	What is there	What to know
Hugging Face	Nearly every model in the world, plus datasets and Spaces	The largest, and everyone’s default — but an open platform anyone can upload to. Safety comes from how you use it, not from a property of the platform
The developer’s official repo	The original model	The safest option: a verified organisational account belonging to whoever built the model. Always the first place to look
Ollama Library	Curated popular models	Some filtering, easy to use, good for beginners; fewer choices and slower to update
ModelScope	Mainly models from China	Some models appear here first, or download faster from Asia. Apply the same checks as on Hugging Face
Kaggle Models	Curated models	Learning and competition oriented, with good accompanying datasets
NGC (NVIDIA)	Models and containers tuned for NVIDIA cards	Useful with TensorRT-LLM, or when you want a pre-tested environment

A number worth knowing before your next download

Over one three-month survey, researchers found 91 models carrying malicious code on public platforms, most of them exploiting weaknesses in pickle deserialization. Impersonation repositories posing as major developers have been reported reaching roughly 240,000 downloads before removal. Meanwhile only about half of organisations scan models before use — while almost all of them use models from public sources. The gap between those two figures is where attackers work.

7.2 Reading a repository before you download

What to check	Good sign	Danger sign
Uploader	A verified organisation with other models and a long history	A newly created account, one model, no history
Repository name	Matches the official blog post or paper	A near-miss spelling, or a claim to be a major company under a personal account
File format	safetensors available	Only .bin / .pt / .pth
Model card	States training method, data, limitations, evaluation results	Empty, or generic copied text
Accompanying files	config.json, tokenizer and licence all present	Odd .py scripts not needed to load the model
Downloads and likes	High and steady over a long period	A sharp spike over a few days
Platform warnings	No warning badge	A badge saying unsafe files were detected — platforms label but do not block the download
Commit history	Consistent with announced updates	A quiet commit editing weight files after the model became popular

7.3 Downloading with the version pinned

Name the commit sha explicitly. Never point at main in a system that runs for real.

huggingface-cli download Qwen/Qwen3-8B \
  --revision a1b2c3d4e5f6... \
  --local-dir ./models/qwen3-8b

In code:

from transformers import AutoModelForCausalLM

model = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen3-8B",
    revision="a1b2c3d4e5f6...",   # pin the version
    use_safetensors=True,          # insist on the safe format
    trust_remote_code=False,       # do not run code from the repo (chapter 8)
)

Record file hashes so you can verify later:

sha256sum ./models/qwen3-8b/*.safetensors > models.sha256
sha256sum -c models.sha256      # re-check before every use in critical systems

# Use an internal mirror if you have several machines
export HF_ENDPOINT=https://your-internal-mirror.example.com

The limit of pinning

Pinning a commit stops a future malicious update from reaching you. It does not help if the commit you pinned was already poisoned — in that case you have pinned the poison. Pinning is necessary and insufficient: pair it with choosing trustworthy sources and scanning before use.

What this chapter settles

Start from the developer’s official repository. Read the repository against the checklist before downloading. Prefer safetensors when it is offered. Pin a commit sha rather than tracking main, and keep hashes to re-verify. And remember that pinning defends against what might arrive later, not against what was already placed there.

The next chapter goes into where the danger actually is — from pickle executing code at load time through to the risks that appear only in production.