TRF014

trust_remote_code should never be used in native model integrations.

Default	Enabled
Scope	All models
Source	mlinter/trf014.py
Show in terminal	mlinter --rule TRF014

What it does

Checks whether trust_remote_code is passed or used in code (e.g. as kwarg) within native model integration files.

Why is this bad?

trust_remote_code allows arbitrary loading, including binaries, which should only be a power feature for users, not a standard use-case. Native integrations must not depend on it, as remote code cannot be reviewed or maintained within transformers.

Example

 class AcmeModel(AcmePreTrainedModel):
     def __init__(self, config):
         super().__init__(config)
-        self.model = AutoModel.from_pretrained(..., trust_remote_code=True)
+        self.model = AutoModel.from_pretrained(...)

Suppressing this rule

Add a # trf-ignore: TRF014 comment on the flagged line or the line directly above it. See Suppressing rules for whole-file directives and when a suppression is the wrong answer.

Allowlisted models

1 model are exempt from TRF014 in mlinter/rules.toml, because they predate the convention and cannot be changed without breaking backward compatibility.

Show the 1 allowlisted model

• auto