jonatasgrosman/wav2vec2-large-xlsr-53-portuguese warn
chat template: not in config · view on Hugging Face ↗
Ingot findings
Static battery: 2 medium finding(s). Deep battery (behavioral differential, glitch-token pass) not yet run. Scanned 2026-08-20 (published from a community scan).
medium Pickle-serialized weights, no safetensors
Weights ship only as pickle-based files (pytorch_model.bin). Loading pickle executes arbitrary code from the file — prefer a safetensors release or load in a sandbox.
How to fix
Convert the weights to safetensors before loading them anywhere that matters.
- Do not load the pickle files in-process — pickle deserialization executes arbitrary code from the file.
- Convert locally in a sandbox: `pip install safetensors` and use `safetensors.torch.save_file` on a state dict loaded with `torch.load(..., weights_only=True)` (refuses most code-execution payloads), or use Hugging Face's `convert.py` space/script.
- Pin the exact revision hash you converted from, and load only your converted safetensors artifact from then on.
medium Repo ships executable Python (trust_remote_code)
The repository contains custom code files that run in-process when loaded with trust_remote_code=True. Pin the revision hash and review the code before loading.
How to fix
Review and pin the custom code; never float on `main` with trust_remote_code=True.
- Read every `.py` file in the repo before first load — this code runs in your process.
- Pin the revision: `from_pretrained(model_id, revision="<commit sha>", trust_remote_code=True)` so a later push can't swap the code under you.
- Prefer a version of the architecture already in `transformers` if one exists, which removes the remote-code requirement entirely.
Remediation guidance addresses the documented findings only. It is evidence-driven repair, not a safety certification of the model.
Verdict badge
Ship the verdict in your README — it always shows the latest published analysis:
[](https://ingot.tools/models/jonatasgrosman/wav2vec2-large-xlsr-53-portuguese)