mlflow/mlflow · error · MlflowException

Deserializing custom objects using cloudpickle is disallowed

Error message

Deserializing custom objects using cloudpickle is disallowed, but this model was saved with custom objects in pickle format. To address this issue, you need to set environment variable 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' to 'true'.

What it means

MLflow blocks deserializing Keras custom objects from cloudpickle by default as a security measure (pickle deserialization can execute arbitrary code). If a model was saved with custom_objects (pickle format) and _load_custom_objects runs without explicit opt-in, it raises MlflowException instructing the user to set MLFLOW_ALLOW_PICKLE_DESERIALIZATION=true.

Source

Thrown at mlflow/tensorflow/__init__.py:557

    # Save `requirements.txt`
    write_to(os.path.join(path, _REQUIREMENTS_FILE_NAME), "\n".join(pip_requirements))

    _PythonEnv.current().to_yaml(os.path.join(path, _PYTHON_ENV_FILE_NAME))


def _load_custom_objects(path, file_name):
    custom_objects_path = None
    if os.path.isdir(path):
        if os.path.isfile(os.path.join(path, file_name)):
            custom_objects_path = os.path.join(path, file_name)
    if custom_objects_path is not None:
        if (
            not MLFLOW_ALLOW_PICKLE_DESERIALIZATION.get()
            and not is_in_databricks_runtime()
            and not is_in_databricks_model_serving_environment()
        ):
            raise MlflowException(
                "Deserializing custom objects using cloudpickle is disallowed, but this model "
                "was saved with custom objects in pickle format. To address this issue, you need "
                "to set environment variable 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' to 'true'."
            )
        import cloudpickle

        with open(custom_objects_path, "rb") as f:
            return cloudpickle.load(f)


def _load_keras_model(model_path, keras_module, save_format, **kwargs):
    keras_models = importlib.import_module(keras_module.__name__ + ".models")
    custom_objects = kwargs.pop("custom_objects", {})
    if saved_custom_objects := _load_custom_objects(model_path, _CUSTOM_OBJECTS_SAVE_PATH):
        saved_custom_objects.update(custom_objects)
        custom_objects = saved_custom_objects

    if global_custom_objects := _load_custom_objects(model_path, _GLOBAL_CUSTOM_OBJECTS_SAVE_PATH):

View on GitHub (pinned to 6a27f2decc)

Solutions

Set the environment variable MLFLOW_ALLOW_PICKLE_DESERIALIZATION=true (or MLFLOW_ALLOW_LOCAL_FILE_URI_AND_MODEL_URI_ACCESS pattern env) before loading, e.g. os.environ["MLFLOW_ALLOW_PICKLE_DESERIALIZATION"] = "true"
Only do this if you trust the model source — pickle deserialization can execute arbitrary code
Re-save the model without cloudpickle custom objects, providing custom objects via load_model's custom_objects argument instead of pickle
Run within a trusted environment where MLflow explicitly allows it (Databricks runtime/model serving)

Example fix

// before
model = mlflow.tensorflow.load_model(model_uri)  # MlflowException
// after
os.environ["MLFLOW_ALLOW_PICKLE_DESERIALIZATION"] = "true"  # only if model source is trusted
model = mlflow.tensorflow.load_model(model_uri)

Defensive patterns

Strategy: validation

Validate before calling

import os
if not os.environ.get("MLFLOW_ALLOW_PICKLE_DESERIALIZATION", "").lower() == "true":
    raise RuntimeError("Set MLFLOW_ALLOW_PICKLE_DESERIALIZATION=true to load models with pickled custom objects")

Try / catch

try:
    model = mlflow.tensorflow.load_model(model_uri)
except MlflowException as e:
    if "MLFLOW_ALLOW_PICKLE_DESERIALIZATION" in str(e) and trusted_source:
        os.environ["MLFLOW_ALLOW_PICKLE_DESERIALIZATION"] = "true"
        model = mlflow.tensorflow.load_model(model_uri)
    else:
        raise

Prevention

Only enable pickle deserialization for model sources you fully trust
Re-save models passing custom objects through load-time APIs instead of cloudpickle
Check the MLmodel metadata to know in advance whether custom pickled objects are present
Keep this flag off in shared/multi-tenant environments

When it happens

Trigger: Calling mlflow.tensorflow.load_model on a model saved with custom objects (via cloudpickle) when MLFLOW_ALLOW_PICKLE_DESERIALIZATION is not 'true', the runtime is not Databricks, and the process is not in the Databricks model serving environment.

Common situations: Loading a Keras model with custom layers/losses saved from another environment; moving a model from a Databricks runtime (where this is allowed) to local execution; hardened environments where security policy forbids enabling pickle deserialization.

Related errors

AI-assisted analysis of mlflow/mlflow@6a27f2decc (2026-08-29). Data as JSON: /api/errors/224a3e00ddd32af0. Report an issue: GitHub.