Default to weights_only=True when loading pretrained weights

[fjankovi]

Summary

WeightsEnum.get_state_dict (torchvision/models/_api.py) is the single funnel through which all pretrained checkpoints are loaded. It forwards to torch.hub.load_state_dict_from_url, which passes weights_only explicitly to torch.load (its own default is False).

Because it is passed explicitly, this path does not benefit from the weights_only=True default that torch.load adopted in PyTorch 2.6 — that default only applies when the argument is left unset. As a result, a tampered checkpoint can still execute arbitrary code via pickle during unpickling, on any torch version, if an attacker can influence the bytes that are loaded (e.g. a poisoned ~/.cache/torch/hub/checkpoints/ entry, or control of the served bytes). check_hash=True only compares the 8-hex (32-bit) filename prefix, which is not a meaningful integrity barrier against an attacker who controls the contents.

This sets weights_only=True by default in get_state_dict, using setdefault so callers can still override it if they have a specific reason to.

Change

def get_state_dict(self, *args: Any, **kwargs: Any) -> dict[str, Any]:
    kwargs.setdefault("weights_only", True)
    return load_state_dict_from_url(self.url, *args, **kwargs)

Compatibility

Verified that both float and quantized checkpoints still load with weights_only=True:

checkpoint	loads?
resnet18 (float)	yes
resnet50_fbgemm (quantized)	yes
googlenet_fbgemm (quantized)	yes

Quantized weights were the main compatibility risk, and they load because the tensor/qtensor rebuild functions they rely on are already on torch's weights_only allowlist.

This mirrors the weights_only=True pattern already used in the datasets code (imagenet.py, mnist.py, phototour.py).

Opened as a draft for discussion.

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/vision/9632

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

This comment was automatically generated by Dr. CI and updates every 15 minutes.

[meta-cla]

Hi @fjankovi!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!