{"record":{"id":"488cd3319dc7dfd3","repo":"unslothai/unsloth","slug":"non-gguf-diffusion-loads-are-restricted-to-unsloth","errorCode":null,"errorMessage":"Non-GGUF diffusion loads are restricted to unsloth/* repos (or a local path); got '{repo_id}'. Pass a gguf_filename to load a GGUF instead.","messagePattern":"Non-GGUF diffusion loads are restricted to unsloth/\\* repos \\(or a local path\\); got '(.+?)'\\. Pass a gguf_filename to load a GGUF instead\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"studio/backend/core/inference/diffusion.py","lineNumber":1657,"sourceCode":"\n        if not family_buildable_here(fam, model_kind = kind):\n            assert_pipeline_class_available(fam.pipeline_class, fam.name)\n        # Families whose single file IS the whole pipeline have no GGUF path; reject before eviction.\n        if kind == \"gguf\" and fam.single_file_is_pipeline:\n            raise ValueError(\n                f\"'{fam.name}' checkpoints are whole-pipeline single files and have no GGUF \"\n                f\"transformer variant; load the .safetensors pipeline instead of a GGUF.\"\n            )\n        # A multi-denoiser family (Ideogram 4) has no transformer-only path; reject before eviction.\n        if kind in (\"gguf\", \"single_file\") and fam.pipeline_only:\n            raise ValueError(\n                f\"'{fam.name}' loads only as a full diffusers pipeline (it assembles \"\n                f\"multiple transformers), not from a single-file or GGUF checkpoint; \"\n                f\"select the pipeline repo.\"\n            )\n        # Non-GGUF loads fetch + deserialise weights, so gate to unsloth/ or a local path.\n        if kind != \"gguf\" and not _is_trusted_diffusion_repo(repo_id):\n            raise ValueError(\n                f\"Non-GGUF diffusion loads are restricted to unsloth/* repos (or a local \"\n                f\"path); got '{repo_id}'. Pass a gguf_filename to load a GGUF instead.\"\n            )\n        # The companion base repo also loads via from_pretrained, so it must clear the same trust bar.\n        if base_repo and base_repo.strip() and not _is_trusted_diffusion_repo(base_repo):\n            raise ValueError(\n                f\"base_repo is restricted to unsloth/* repos (or a local path); got '{base_repo}'.\"\n            )\n        # A local base_repo loads as a full pipeline; reject a non-pipeline one before eviction.\n        _assert_local_base_is_pipeline(base_repo)\n        # Reject a bad LOCAL pick before the route evicts chat: a path-shaped repo_id must be on disk.\n        local_root = Path(repo_id).expanduser()\n        # Path-shaped: \".\"/\"..\" prefix, a backslash (never in \"org/name\"), or an absolute path.\n        path_shaped = (\n            repo_id.startswith((\"/\", \"\\\\\", \"~\", \".\")) or \"\\\\\" in repo_id or local_root.is_absolute()\n        )\n        if kind in (\"gguf\", \"single_file\"):\n            if not gguf_filename:","sourceCodeStart":1639,"sourceCodeEnd":1675,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/core/inference/diffusion.py#L1639-L1675","documentation":"Security gate: non-GGUF loads (pipeline and single_file) fetch and deserialize weights via from_pretrained/from_single_file, so they are restricted to the unsloth/* org, a short allowlist of official safetensors base repos (_TRUSTED_NON_GGUF_REPOS, e.g. the SDXL base), and existing local paths. Any other repo id with kind != 'gguf' raises this ValueError naming the offending id and pointing at the GGUF path.","triggerScenarios":"Calling a non-GGUF load with a repo id that is not an existing local path, not under unsloth/, and not in _TRUSTED_NON_GGUF_REPOS - e.g. 'stabilityai/stable-diffusion-3.5-large' or any third-party org - without a gguf_filename.","commonSituations":"User copies a repo id straight from Hugging Face that belongs to the original author org rather than unsloth's republish; a pipeline preset references a repo that was never allowlisted; attempting a single-file .safetensors load from an arbitrary org.","solutions":["Find the unsloth/* mirror of the model (unsloth republishes the curated safetensors bases) and use that id.","Or pass a gguf_filename to switch the load to the GGUF path, which is open to any repo.","Or download the repo yourself and pass the local directory path - local paths the user points at are trusted.","If the official repo should be trusted, get it added to _TRUSTED_NON_GGUF_REPOS in the backend."],"exampleFix":"# before: third-party org, non-GGUF\nmanager.validate_load_request(repo_id=\"stabilityai/stable-diffusion-3.5-large\")\n# ValueError: Non-GGUF diffusion loads are restricted to unsloth/* ...\n\n# after: curated mirror (or pass gguf_filename, or a local path)\nmanager.validate_load_request(repo_id=\"unsloth/stable-diffusion-3.5-large\")","handlingStrategy":"validation","validationCode":"from pathlib import Path\n\ndef non_gguf_load_allowed(repo_id: str) -> bool:\n    try:\n        if Path(repo_id).expanduser().exists():\n            return True\n    except OSError:\n        pass\n    rid = repo_id.strip().lower()\n    return rid.startswith(\"unsloth/\")  # or membership in _TRUSTED_NON_GGUF_REPOS","typeGuard":null,"tryCatchPattern":"try:\n    fam = manager.validate_load_request(repo_id=r, model_kind=k, gguf_filename=f)\nexcept ValueError as e:\n    if \"restricted to unsloth/*\" in str(e):\n        suggest_unsloth_mirror_or_gguf(r)\n    else:\n        raise","preventionTips":["Prefer unsloth/* ids for pipeline and single-file loads; they are the curated surface by design.","When pasting an HF link, check the org: the original author org is usually not allowlisted for non-GGUF loads.","Local downloads are trusted: clone/snapshot the repo locally and pass the path when you must use a third-party org.","Keep GGUF loads for everything else - the GGUF path stays open to any repo."],"tags":["security","trust-gate","unsloth","huggingface","model-validation","diffusion"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}