TRF014

trust_remote_code should never be used in native model integrations.

Default	Enabled
Scope	All models
Source	mlinter/trf014.py
Show in terminal	mlinter --rule TRF014

What it does

Flags trust_remote_code used or passed (e.g. as a kwarg) in native model integration files.

Why is this bad?

trust_remote_code loads arbitrary code, including binaries – a power feature for users, not something a native integration may depend on, since remote code cannot be reviewed or maintained in transformers.

Example

 class AcmeModel(AcmePreTrainedModel):
     def __init__(self, config):
         super().__init__(config)
-        self.model = AutoModel.from_pretrained(..., trust_remote_code=True)
+        self.model = AutoModel.from_pretrained(...)

Suppressing this rule

Add a # trf-ignore: TRF014 comment on the flagged line or the line directly above it. See Suppressing rules for whole-file directives and when a suppression is the wrong answer.

Allowlisted models

1 model are exempt from TRF014 in mlinter/rules.toml, because they predate the convention and cannot be changed without breaking backward compatibility.

Show the 1 allowlisted model

• auto