Machine learning models are increasingly distributed through centralized repositories such as Hugging Face. These models rely on a variety of serialization formats and on complex software libraries for deserialization. This introduces risks into the supply chains of applications using those models as deserialization is prone to vulnerabilities. In this paper, we study and quantify this risk by conducting a large-scale empirical study of model serialization formats used in the Hugging Face ecosystem. We analyze a snapshot of 10,000 models on Hugging Face across 39 time points (56,533 models in total) and study the prevalence of 41 serialization formats.
