You pull a pre-trained model from a public hub to run in production. What do you verify first?

Grabbing a pre-trained model from a public hub feels as routine as pip install. That's exactly the problem: you're pulling an opaque binary artifact authored by a stranger and running it inside your production trust boundary. Treat it like any other supply-chain dependency.

What to verify first

• Provenance and integrity. Is it from a trusted, expected publisher, or a typosquatted lookalike? Verify the artifact against published checksums/signatures so you know you got the exact file the author released and not a tampered copy. Prefer signed releases and pinned versions.
• License. Many "open" models carry usage restrictions — non-commercial clauses, acceptable-use policies, attribution, or restrictions inherited from training data. Confirm the license actually permits your intended production and commercial use before you depend on it.
• Safe loading (no arbitrary code execution). This is the sharp one. Classic checkpoint formats based on Python pickle can execute arbitrary code the moment you load them — loading the model is running attacker code. Prefer safe serialization formats (e.g. safetensors), scan artifacts, and load untrusted models in a sandbox.

Why this matters

A poisoned or backdoored model can behave normally in testing and misbehave on a trigger, and an unsafe-deserialization payload can compromise the host before the model ever produces an output. None of that shows up in "does it load."

Why the distractors are wrong

• "Only that it loads": loading proves nothing about trust — and with pickle-style formats, loading is the very thing that can execute the attack.
• "Download speed": irrelevant to security entirely.
• "Public models are inherently safe": they are not. Public hubs host poisoned, backdoored, and malicious-payload artifacts; "public" is not "vetted."

What interviewers want to hear

That you treat the model as an untrusted supply-chain dependency and gate it on provenance/integrity (checksums, signatures, trusted source), license compatibility, and safe deserialization/sandboxed loading — not on whether it merely runs.