{"record":{"id":"8ad7eef1a3822137","repo":"unslothai/unsloth","slug":"embedding-model-name-r-reason-refusing-to-loa","errorCode":null,"errorMessage":"Embedding model {name!r} {reason}; refusing to load. Set a different RAG embedding model.","messagePattern":"Embedding model (.+?) (.+?); refusing to load\\. Set a different RAG embedding model\\.","errorType":"exception","errorClass":"UnsafeEmbeddingModelError","httpStatus":null,"severity":"critical","filePath":"studio/backend/core/rag/embeddings.py","lineNumber":233,"sourceCode":"            # Transformer module dir blocks instead of passing as an unreferenced nested shard.\n            load_subdirs = tuple(\n                dict.fromkeys(\n                    (*security_load_subdirs(name, token), *_st_module_subdirs(name, token))\n                )\n            )\n        blocked = evaluate_file_security(\n            name, hf_token = token, load_subdirs = load_subdirs, local_only_load = local_only\n        ).blocked\n    except Exception:\n        return\n    if blocked:\n        reason = (\n            \"has cached pickle weights that cannot be security-scanned offline and no \"\n            \"safetensors alternative\"\n            if local_only\n            else \"is flagged as unsafe by Hugging Face's security scan\"\n        )\n        raise UnsafeEmbeddingModelError(\n            f\"Embedding model {name!r} {reason}; refusing to load. \"\n            \"Set a different RAG embedding model.\"\n        )\n\n\n_ANSI_RE = re.compile(r\"\\x1b\\[[0-9;]*m\")\n\n\nclass _CaptureLoadReport(logging.Filter):\n    \"\"\"Swallow transformers' multi-line \"<Model> LOAD REPORT\" table, keeping the text.\n\n    transformers >= 5 emits the report through ``logger.warning`` with embedded ANSI\n    colour codes, so it lands in the server log as ~7 unstructured lines that break\n    every JSON consumer. It fires on every boot for the RAG embedder because\n    bge-small-en-v1.5 ships a legacy ``embeddings.position_ids`` key that the current\n    BertModel does not expect, which is benign and identical every time.\n\n    Nothing is lost: the caller re-emits the report (see ``_quiet_transformers_load``)","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/core/rag/embeddings.py#L215-L251","documentation":"UnsafeEmbeddingModelError raised when evaluate_file_security flags the requested Hugging Face embedding model as unsafe to load. There are two flavors: in local-only mode, the model has cached pickle (.bin) weights that cannot be security-scanned offline and no safetensors alternative; online, the repo is flagged by Hugging Face's security scan (e.g. pickle scanning reported malicious content). The RAG layer refuses to unpickle such files because pickle deserialization is arbitrary code execution.","triggerScenarios":"Setting the RAG embedding model to a repo whose only weights are pytorch_model.bin (pickle) while HF_HUB_OFFLINE/local_only caching prevents scanning; naming a repo that HF has flagged for malicious pickle payloads; a cached snapshot whose safetensors file was deleted.","commonSituations":"Pinning older embedding models that predate safetensors; air-gapped installs that cached .bin weights only; typosquatting or intentionally testing a known-malicious 'model' repo.","solutions":["Choose an embedding model that ships safetensors weights (most current BGE/E5/GTE/minilm releases do).","If offline, pre-download the safetensors variant of the model so the scan can clear it, or switch to local-only scanning-compatible caches.","Clear the stale cache (rm -rf the model's snapshot under ~/.cache/huggingface) and re-download so the security evaluation re-runs.","Never bypass by unpickling manually — treat a flagged model as compromised."],"exampleFix":"# before\nRAG_EMBEDDING_MODEL=some/old-model  # only has pytorch_model.bin\n\n# after\nRAG_EMBEDDING_MODEL=BAAI/bge-small-en-v1.5  # safetensors weights, scans clean","handlingStrategy":"validation","validationCode":"from core.rag.security import evaluate_file_security  # adjust import to project layout\n\ndef embedding_model_safe(name: str, *, token=None, local_only=False) -> bool:\n    try:\n        return not evaluate_file_security(\n            name, hf_token=token, load_subdirs=True, local_only_load=local_only\n        ).blocked\n    except Exception:\n        return True  # matches loader behavior: unscannable != blocked","typeGuard":null,"tryCatchPattern":"try:\n    model = load_embedding_model(name)\nexcept UnsafeEmbeddingModelError as e:\n    log.error(\"refusing unsafe model %s: %s\", name, e)\n    name = \"BAAI/bge-small-en-v1.5\"  # known safetensors default\n    model = load_embedding_model(name)","preventionTips":["Standardize the org's embedding models on repos that ship safetensors weights.","Pre-download safetensors snapshots for offline/air-gapped installs so the security scan can clear them.","Never unpickle flagged weights manually; a blocked model is a security incident, not an inconvenience."],"tags":["security","huggingface","pickle","embeddings","model-loading"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}