Is a downloaded AI model safe to run?

What does safe mean for a local model?

Start with the exact repository and file, including the quantizer or fine-tune publisher. Keep your runner updated and read its supported formats. Loading weights, executing repository code, answering accurately and keeping prompts private are separate questions. An automated scan that reports no findings covers only its checks.

Scroll sideways to read all columns. With a keyboard, focus the table and use the left and right arrow keys.

An exact Qwen GGUF example

The table is a dated metadata observation, checked on 26 October 2026. The publisher file record and Hugging Bay record agree on the size and recorded hash. This guide did not download or rehash the model, run inference, or measure its memory use. Use the current file page for availability.

Check the downloaded bytes

After obtaining that exact file, calculate its SHA-256 locally. On macOS:

shasum -a 256 qwen2.5-0.5b-instruct-q4_k_m.gguf

On Linux:

sha256sum qwen2.5-0.5b-instruct-q4_k_m.gguf

In Windows PowerShell:

Get-FileHash -Algorithm SHA256 .\qwen2.5-0.5b-instruct-q4_k_m.gguf

Compare all 64 hexadecimal characters against the trusted, pinned source record. If they differ, do not load the file until you resolve the mismatch. A match cannot establish who is trustworthy, that a loader is secure, that the model will fit, or that its answers are reliable. A signed manifest and a hash are different evidence; do not call an unsigned record signed.

Check what the loader will execute

Hugging Face documents that unpickling can execute arbitrary code. Prefer a supported tensor format that avoids pickle when your runner offers one, and inspect any accompanying scripts or install commands. Transformers custom models may require trust_remote_code=True; review that code and pin the revision before enabling it. GGUF and Safetensors are different formats and need compatible loaders. Neither extension is a blanket safety certificate. Hugging Face loading guidance explains the custom-code boundary.

Check licence and output claims

An uncensored or abliterated label describes a publisher claim, not a security test or a measured guarantee about every reply. Check the base model, changes, licence and task evidence. A conversion or fine-tune does not by itself establish new permission to use the original weights. Missing licence information is unresolved permission, not proof of a permissive licence. For network settings and offline limits, read local privacy.