Comment by samtheprogram
1 year ago
To clarify this further, pickle was more common ~10+ years ago I’d say? Hence the “historically”
It wasn’t designed (well enough?) to be read safely so malware or other arbitrary data could be injected into models (to compromise the machine running the model, as opposed to the outputs like in the article), which safetensors was made to avoid.
Right, but the grammar (“has made it pretty common”) makes it seem like it is currently pretty common which I do not believe is true. I don’t even know if it was commonly exploited in the past, honestly.
Pickle is still very common with scikit-learn models :/