unslothai/unsloth · critical · UnsafeEmbeddingModelError

Embedding model {name!r} {reason}; refusing to load. Set a d

Error message

Embedding model {name!r} {reason}; refusing to load. Set a different RAG embedding model.

What it means

UnsafeEmbeddingModelError raised when evaluate_file_security flags the requested Hugging Face embedding model as unsafe to load. There are two flavors: in local-only mode, the model has cached pickle (.bin) weights that cannot be security-scanned offline and no safetensors alternative; online, the repo is flagged by Hugging Face's security scan (e.g. pickle scanning reported malicious content). The RAG layer refuses to unpickle such files because pickle deserialization is arbitrary code execution.

Source

Thrown at studio/backend/core/rag/embeddings.py:233

            # Transformer module dir blocks instead of passing as an unreferenced nested shard.
            load_subdirs = tuple(
                dict.fromkeys(
                    (*security_load_subdirs(name, token), *_st_module_subdirs(name, token))
                )
            )
        blocked = evaluate_file_security(
            name, hf_token = token, load_subdirs = load_subdirs, local_only_load = local_only
        ).blocked
    except Exception:
        return
    if blocked:
        reason = (
            "has cached pickle weights that cannot be security-scanned offline and no "
            "safetensors alternative"
            if local_only
            else "is flagged as unsafe by Hugging Face's security scan"
        )
        raise UnsafeEmbeddingModelError(
            f"Embedding model {name!r} {reason}; refusing to load. "
            "Set a different RAG embedding model."
        )


_ANSI_RE = re.compile(r"\x1b\[[0-9;]*m")


class _CaptureLoadReport(logging.Filter):
    """Swallow transformers' multi-line "<Model> LOAD REPORT" table, keeping the text.

    transformers >= 5 emits the report through ``logger.warning`` with embedded ANSI
    colour codes, so it lands in the server log as ~7 unstructured lines that break
    every JSON consumer. It fires on every boot for the RAG embedder because
    bge-small-en-v1.5 ships a legacy ``embeddings.position_ids`` key that the current
    BertModel does not expect, which is benign and identical every time.

    Nothing is lost: the caller re-emits the report (see ``_quiet_transformers_load``)

View on GitHub (pinned to 203007d190)

Solutions

1. Choose an embedding model that ships safetensors weights (most current BGE/E5/GTE/minilm releases do).
2. If offline, pre-download the safetensors variant of the model so the scan can clear it, or switch to local-only scanning-compatible caches.
3. Clear the stale cache (rm -rf the model's snapshot under ~/.cache/huggingface) and re-download so the security evaluation re-runs.
4. Never bypass by unpickling manually — treat a flagged model as compromised.

Example fix

# before
RAG_EMBEDDING_MODEL=some/old-model  # only has pytorch_model.bin

# after
RAG_EMBEDDING_MODEL=BAAI/bge-small-en-v1.5  # safetensors weights, scans clean

from core.rag.security import evaluate_file_security  # adjust import to project layout

def embedding_model_safe(name: str, *, token=None, local_only=False) -> bool:
    try:
        return not evaluate_file_security(
            name, hf_token=token, load_subdirs=True, local_only_load=local_only
        ).blocked
    except Exception:
        return True  # matches loader behavior: unscannable != blocked

try:
    model = load_embedding_model(name)
except UnsafeEmbeddingModelError as e:
    log.error("refusing unsafe model %s: %s", name, e)
    name = "BAAI/bge-small-en-v1.5"  # known safetensors default
    model = load_embedding_model(name)

When it happens

Trigger: Setting the RAG embedding model to a repo whose only weights are pytorch_model.bin (pickle) while HF_HUB_OFFLINE/local_only caching prevents scanning; naming a repo that HF has flagged for malicious pickle payloads; a cached snapshot whose safetensors file was deleted.

Common situations: Pinning older embedding models that predate safetensors; air-gapped installs that cached .bin weights only; typosquatting or intentionally testing a known-malicious 'model' repo.

Related errors

• {model!r} has cached pickle weights that cannot be security-
• VirusTotal request failed after {max_attempts} attempt(s): {
• Non-GGUF diffusion loads are restricted to unsloth/* repos (
• {_cn_fs.reason}
• {error_msg} (dynamic, from format_error_message: e.g. "Model

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/8ad7eef1a3822137. Report an issue: GitHub.