# Is a downloaded AI model safe to run?

<a id="short-answer"></a>

A model name or matching SHA-256 cannot establish that a model is safe to run. Check the exact publisher, revision, files and loader; assess code execution, output behaviour, licence and privacy separately. A hash match checks file integrity against a reference.

Sources checked: 2026-10-26

<a id="safety-checks"></a>

## What does safe mean for a local model?

Start with the exact repository and file, including the quantizer or fine-tune publisher. Keep your runner updated and read its supported formats. Loading weights, executing repository code, answering accurately and keeping prompts private are separate questions. An automated scan that reports no findings covers only its checks.

| Question | What to check | What it establishes |
| --- | --- | --- |
| Did I get the intended file? | Publisher, pinned revision, complete filename, byte count and SHA-256 | A local hash match establishes agreement with the reference bytes |
| Could loading execute code? | File format, loader and any custom repository code | Pickle can execute code on load; review code before enabling trust_remote_code |
| Is a safer tensor format enough? | Safetensors avoids pickle deserialization; check the rest of the software too | A file format does not certify the loader, outputs or privacy |
| Will answers be reliable? | Model card and your own task tests | A name, scan or uncensored label does not validate future answers |
| Can I use it for my project? | Upstream licence and derivative terms | Read the terms; an unknown licence leaves permission unresolved |
| Will my prompts stay local? | Runner mode, remote endpoints, tools and network settings | Offline inference requires the necessary files locally and a local execution path |

<a id="qwen-file-facts"></a>

## An exact Qwen GGUF example

The table is a dated metadata observation, checked on 26 October 2026. The [publisher file record](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF/blob/9217f5db79a29953eb74d5343926648285ec7e67/qwen2.5-0.5b-instruct-q4_k_m.gguf) and [Hugging Bay record](/artifact/hf-model-qwen-qwen2-5-0-5b-instruct-gguf) agree on the size and recorded hash. This guide did not download or rehash the model, run inference, or measure its memory use. Use the current file page for availability.

| Fact | Recorded value |
| --- | --- |
| Publisher repository | Qwen/Qwen2.5-0.5B-Instruct-GGUF |
| Revision | 9217f5db79a29953eb74d5343926648285ec7e67 |
| File | qwen2.5-0.5b-instruct-q4_k_m.gguf |
| Size | 491,400,032 bytes (0.4914 decimal GB) |
| Memory needed | Not measured here; allow additional memory for the runner, context cache, OS and other apps |
| Declared licence | Apache-2.0; read the publisher terms |
| Recorded SHA-256 | 74a4da8c9fdbcd15bd1f6d01d621410d31c6fc00986f5eb687824e7b93d7a9db |
| Verification in this guide | Metadata agreement only; no local byte rehash or model execution |

<a id="verify-sha256"></a>

## Check the downloaded bytes

After obtaining that exact file, calculate its SHA-256 locally. On macOS:

```sh
shasum -a 256 qwen2.5-0.5b-instruct-q4_k_m.gguf
```

On Linux:

```sh
sha256sum qwen2.5-0.5b-instruct-q4_k_m.gguf
```

In Windows PowerShell:

```powershell
Get-FileHash -Algorithm SHA256 .\qwen2.5-0.5b-instruct-q4_k_m.gguf
```

Compare all 64 hexadecimal characters against the trusted, pinned source record. If they differ, do not load the file until you resolve the mismatch. A match cannot establish who is trustworthy, that a loader is secure, that the model will fit, or that its answers are reliable. A signed manifest and a hash are different evidence; do not call an unsigned record signed.

<a id="custom-code"></a>

## Check what the loader will execute

Hugging Face documents that unpickling can execute arbitrary code. Prefer a supported tensor format that avoids pickle when your runner offers one, and inspect any accompanying scripts or install commands. Transformers custom models may require `trust_remote_code=True`; review that code and pin the revision before enabling it. GGUF and Safetensors are different formats and need compatible loaders. Neither extension is a blanket safety certificate. [Hugging Face loading guidance](https://huggingface.co/docs/transformers/models#custom-models) explains the custom-code boundary.

<a id="licence-and-output"></a>

## Check licence and output claims

An uncensored or abliterated label describes a publisher claim, not a security test or a measured guarantee about every reply. Check the base model, changes, licence and task evidence. A conversion or fine-tune does not by itself establish new permission to use the original weights. Missing licence information is unresolved permission, not proof of a permissive licence. For network settings and offline limits, read [local privacy](/learn/privacy).

<a id="learn-sources"></a>

## Sources

- [Hugging Face pickle security](https://huggingface.co/docs/hub/security-pickle)
- [Transformers model loading and custom code](https://huggingface.co/docs/transformers/models#custom-models)
- [Safetensors format documentation](https://huggingface.co/docs/safetensors/index)
- [Qwen publisher model card and declared licence](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF)
- [Pinned Qwen file size and LFS hash](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF/blob/9217f5db79a29953eb74d5343926648285ec7e67/qwen2.5-0.5b-instruct-q4_k_m.gguf)
- [Hugging Bay exact Qwen file metadata](https://huggingbay.xyz/api/artifacts/hf-model-qwen-qwen2-5-0-5b-instruct-gguf)
- [Ollama settings and privacy](https://docs.ollama.com/faq)
- [LM Studio offline operation](https://lmstudio.ai/docs/app/offline)

[Inspect Qwen GGUF records](/browse?q=Qwen%20GGUF)