PyTorch Foundation / breaking change
PyTorch 2.6 makes weights-only checkpoint loading the default
PyTorch 2.6 changed torch.load to behave as weights_only=True when callers do not provide a custom pickle_module. Plain tensor state dictionaries should continue loading, while serialized modules, tensor subclasses, NumPy objects, and other custom globals can now fail until the caller chooses an explicit trusted-load path or allowlists required types.
- Affected product / version
- PyTorch 2.6 torch.load
- Announced
- Effective
- Source checked
Checked against the linked documentation on 2026-09-07. Recheck the vendor documentation before acting.
What to check in your application
PlaintextML interpretation of the documented change:
- Inventory every
torch.loadcall and make intent explicit: keep weights-only loading for ordinary state dictionaries, and useweights_only=Falseonly for trusted legacy artifacts whose provenance is controlled. - Exercise representative checkpoints in CI;
get_unsafe_globals_in_checkpoint,safe_globals, and TorchFix can identify migration work before a production model refresh.
Limits and uncertainty
The default changes only when pickle_module is omitted, and explicit arguments still control a call. Weights-only loading narrows arbitrary-code execution risk but the PyTorch documentation says it does not prevent denial-of-service and cannot rule out every memory-safety problem.
Official sources
- BC-Breaking Change: torch.load is being flipped to use weights_only=True by default
- PyTorch 2.6 Release Blog
- PyTorch serialization semantics
Revision history
- — Initial record added after checking the linked official documentation; migration checks are editorial interpretation.
Found a problem? Keep the record URL, the claim that needs changing, and the supporting primary source together when reporting it to the publisher.