Hugging Face Transformers 5.20

Apply to applications that load, train, or serve models with Transformers 5.20. Treat model repositories, local checkpoints, processors, adapters, templates, media, and generated text as separate trust boundaries. The Python prompt covers language-wide controls.

Models and checkpoints

• Select model repository IDs and immutable commit revisions in trusted configuration, not from user input. Review the model's configuration, weights, tokenizer or processor, generation configuration, adapters, and referenced repositories as one deployment artifact.
• Pass the approved revision to from_pretrained() and pipeline() loading paths. If custom code resides in a different repository, independently approve and fix code_revision; a weight revision alone does not freeze that code.
• Use local_files_only=True or HF_HUB_OFFLINE=1 for an offline deployment after staging and verifying the exact approved artifacts. A cache hit with online loading can still contact the Hub.
• Require use_safetensors=True when from_pretrained() loads external PyTorch-format weights; review GGUF and other formats separately. The default prefers safetensors but can fall back to PyTorch pickle files; weights_only=True and Hub scanning do not make arbitrary third-party checkpoint content trustworthy.
• Before calling from_pretrained() on a local model directory, validate every filename in model.safetensors.index.json or pytorch_model.bin.index.json weight_map: require a simple expected shard name whose resolved path stays inside the approved model directory; reject absolute paths,