Compare your downloaded files with the checksums Hugging Face records for the exact repository revision you intend to use. Pin that revision by commit hash, download it, then run hf cache verify. For datasets, include --repo-type dataset. A successful check establishes that your local files match that Hub revision; it does not establish that the files or their author are trustworthy.
Verify a model or dataset against a pinned revision
Hugging Face’s CLI documentation describes hf cache verify as the command for validating local files against their checksums on the Hub. Use a commit hash rather than a moving branch such as main when you need a repeatable target. The CLI accepts a commit hash, branch, or tag as a revision. See the Hugging Face CLI reference.
As an Amazon Associate I earn from qualifying purchases.
- Choose the repository and revision. Record the repository ID, whether it is a model or dataset, and the commit hash you intend to use.
- Download that revision. For a model, run
hf download OWNER/REPO --revision COMMIT_HASH. For a dataset, runhf download OWNER/REPO --repo-type dataset --revision COMMIT_HASH. Replace the examples with the repository ID and commit hash you recorded. Keep the hash with your notes. - Check the downloaded files. For a model, run
hf cache verify OWNER/REPO --revision COMMIT_HASH. For a dataset, runhf cache verify OWNER/REPO --repo-type dataset --revision COMMIT_HASH. - Check a local directory instead, if needed. Add
--local-dir /path/to/repoto the verify command to check the files in that directory. The CLI supports both cache snapshots and local directories.
The command reports mismatched files and exits with a non-zero status when it finds a mismatch. Missing or extra files generate warnings by default; add --fail-on-missing-files or --fail-on-extra-files to make those conditions errors. Decide whether missing or extra files should fail your own workflow, since a local directory may intentionally contain additional files.
Recommended Free Tools
What each security check can—and cannot—tell you
| Signal | Useful for | Does not establish |
|---|---|---|
hf cache verify against a pinned revision |
Whether local files match the checksums Hub records for that revision; it also surfaces missing or extra files. | Whether the revision itself is trustworthy, safe, or identical to a separately trusted release. |
| GPG commit status | Whether a commit signature can be verified against the key associated with the account. | That the signer is reputable, the code is safe, or a file is benign. |
| Malware or pickle scanner badge | A platform screening signal about scanned repository files. | Complete detection. An absent badge is not a clean result. |
.safetensors |
Avoiding pickle deserialization for tensor weights in supported loading paths. | Artifact authenticity, dataset safety, or benign model behavior. |
A checksum comparison answers a narrow integrity question: do these local files match the Hub’s recorded checksums for this chosen revision? It does not prove that the original upload was benign or that the revision matches a release you trust independently. A checksum is only as trustworthy as the reference it is compared with.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do if verification fails
- Confirm that the repository ID, repository type, and commit hash are correct. A model-versus-dataset mismatch or a different revision changes the reference you are checking.
- Check whether the download completed and whether the directory contains files mixed from multiple revisions.
- Download the pinned revision again into a clean location and rerun verification.
- If the mismatch remains, do not load or train on the affected files. Preserve the repository ID, commit hash, filenames, and verification output for investigation.
A mismatch means the local file set did not match the reference check; it does not by itself identify why. The retry in a clean directory helps distinguish a partial or mixed local download from a mismatch that persists against the selected revision.
Review provenance and scan status
Hugging Face’s GPG documentation distinguishes signed commits that are Verified (the signature is verified), Unverified (signed but not verifiable), and unsigned commits (no status). A verified signature can support provenance when the signing key belongs to a publisher you trust independently; it is not a safety verdict.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Hugging Face says it runs repository files through a malware scanner, but scanner results are screening rather than a guarantee. Its malware-scanning documentation notes that a missing badge may mean scanning is pending, underway, or has errored, so treat that state as unknown. The pickle-scanning documentation also cautions that detection is not foolproof.
Load weights without confusing format with trust
Prefer .safetensors weights when available and supported. Unlike pickle-based model files, this format avoids pickle deserialization for tensor weights in supported loading paths. Hugging Face warns that unpickling files from sources you do not trust can execute code; do not load a pickle file merely to inspect it. See its pickle-scanning guidance and Safetensors guide.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Safetensors applies to tensor weights, not every repository file. It does not replace revision pinning, checksum verification, provenance review, or inspection of repository code and dataset contents. If a checkpoint has been converted to safetensors through Hugging Face’s Convert Space, the guide says the converted files are submitted in a pull request and can be loaded by selecting that pull-request revision; inspect and verify that resulting revision as well.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
