{"record":{"id":"224a3e00ddd32af0","repo":"mlflow/mlflow","slug":"deserializing-custom-objects-using-cloudpickle-is","errorCode":null,"errorMessage":"Deserializing custom objects using cloudpickle is disallowed, but this model was saved with custom objects in pickle format. To address this issue, you need to set environment variable 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' to 'true'.","messagePattern":"Deserializing custom objects using cloudpickle is disallowed, but this model was saved with custom objects in pickle format\\. To address this issue, you need to set environment variable 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' to 'true'\\.","errorType":"exception","errorClass":"MlflowException","httpStatus":null,"severity":"error","filePath":"mlflow/tensorflow/__init__.py","lineNumber":557,"sourceCode":"\n    # Save `requirements.txt`\n    write_to(os.path.join(path, _REQUIREMENTS_FILE_NAME), \"\\n\".join(pip_requirements))\n\n    _PythonEnv.current().to_yaml(os.path.join(path, _PYTHON_ENV_FILE_NAME))\n\n\ndef _load_custom_objects(path, file_name):\n    custom_objects_path = None\n    if os.path.isdir(path):\n        if os.path.isfile(os.path.join(path, file_name)):\n            custom_objects_path = os.path.join(path, file_name)\n    if custom_objects_path is not None:\n        if (\n            not MLFLOW_ALLOW_PICKLE_DESERIALIZATION.get()\n            and not is_in_databricks_runtime()\n            and not is_in_databricks_model_serving_environment()\n        ):\n            raise MlflowException(\n                \"Deserializing custom objects using cloudpickle is disallowed, but this model \"\n                \"was saved with custom objects in pickle format. To address this issue, you need \"\n                \"to set environment variable 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' to 'true'.\"\n            )\n        import cloudpickle\n\n        with open(custom_objects_path, \"rb\") as f:\n            return cloudpickle.load(f)\n\n\ndef _load_keras_model(model_path, keras_module, save_format, **kwargs):\n    keras_models = importlib.import_module(keras_module.__name__ + \".models\")\n    custom_objects = kwargs.pop(\"custom_objects\", {})\n    if saved_custom_objects := _load_custom_objects(model_path, _CUSTOM_OBJECTS_SAVE_PATH):\n        saved_custom_objects.update(custom_objects)\n        custom_objects = saved_custom_objects\n\n    if global_custom_objects := _load_custom_objects(model_path, _GLOBAL_CUSTOM_OBJECTS_SAVE_PATH):","sourceCodeStart":539,"sourceCodeEnd":575,"githubUrl":"https://github.com/mlflow/mlflow/blob/6a27f2decc0b76eb1b54af31849784addb357dbc/mlflow/tensorflow/__init__.py#L539-L575","documentation":"MLflow blocks deserializing Keras custom objects from cloudpickle by default as a security measure (pickle deserialization can execute arbitrary code). If a model was saved with custom_objects (pickle format) and _load_custom_objects runs without explicit opt-in, it raises MlflowException instructing the user to set MLFLOW_ALLOW_PICKLE_DESERIALIZATION=true.","triggerScenarios":"Calling mlflow.tensorflow.load_model on a model saved with custom objects (via cloudpickle) when MLFLOW_ALLOW_PICKLE_DESERIALIZATION is not 'true', the runtime is not Databricks, and the process is not in the Databricks model serving environment.","commonSituations":"Loading a Keras model with custom layers/losses saved from another environment; moving a model from a Databricks runtime (where this is allowed) to local execution; hardened environments where security policy forbids enabling pickle deserialization.","solutions":["Set the environment variable MLFLOW_ALLOW_PICKLE_DESERIALIZATION=true (or MLFLOW_ALLOW_LOCAL_FILE_URI_AND_MODEL_URI_ACCESS pattern env) before loading, e.g. os.environ[\"MLFLOW_ALLOW_PICKLE_DESERIALIZATION\"] = \"true\"","Only do this if you trust the model source — pickle deserialization can execute arbitrary code","Re-save the model without cloudpickle custom objects, providing custom objects via load_model's custom_objects argument instead of pickle","Run within a trusted environment where MLflow explicitly allows it (Databricks runtime/model serving)"],"exampleFix":"// before\nmodel = mlflow.tensorflow.load_model(model_uri)  # MlflowException\n// after\nos.environ[\"MLFLOW_ALLOW_PICKLE_DESERIALIZATION\"] = \"true\"  # only if model source is trusted\nmodel = mlflow.tensorflow.load_model(model_uri)","handlingStrategy":"validation","validationCode":"import os\nif not os.environ.get(\"MLFLOW_ALLOW_PICKLE_DESERIALIZATION\", \"\").lower() == \"true\":\n    raise RuntimeError(\"Set MLFLOW_ALLOW_PICKLE_DESERIALIZATION=true to load models with pickled custom objects\")","typeGuard":null,"tryCatchPattern":"try:\n    model = mlflow.tensorflow.load_model(model_uri)\nexcept MlflowException as e:\n    if \"MLFLOW_ALLOW_PICKLE_DESERIALIZATION\" in str(e) and trusted_source:\n        os.environ[\"MLFLOW_ALLOW_PICKLE_DESERIALIZATION\"] = \"true\"\n        model = mlflow.tensorflow.load_model(model_uri)\n    else:\n        raise","preventionTips":["Only enable pickle deserialization for model sources you fully trust","Re-save models passing custom objects through load-time APIs instead of cloudpickle","Check the MLmodel metadata to know in advance whether custom pickled objects are present","Keep this flag off in shared/multi-tenant environments"],"tags":["security","pickle","deserialization","keras"],"backgroundTag":"pickle-deserialization-blocked","analyzedSha":"6a27f2decc0b76eb1b54af31849784addb357dbc","analyzedAt":"2026-08-29T20:54:51.419Z","schemaVersion":2},"datasetVersion":"2026-08-29T22:17:34.462Z"}