🛡️ SafetyCard: a free safety report card for any Hugging Face LLM
Is this model safe to download? Is it really derived from the model it claims? Has its safety training been stripped out? Get answers measured from the files and weights themselves.
⚡ Instant file scan
Runs in your browser through the Hugging Face Hub API. No weights are downloaded and nothing is sent to us.
What SafetyCard checks
⚡ File safety, A–F
Pickle files that can run code when loaded, models that need trust_remote_code, the declared base model, the license and Hugging Face's own malware scan.
Instant, in your browser.
🧬 Lineage
Compares weights tensor by tensor with the claimed base model: fine-tuned from it, heavily modified, or not derived from it at all.
Your GPU, or a CPU for small models.
🛡️ Safety structure
Measures whether the model still separates harmful from harmless requests internally, compared with its parent. Uncensoring tends to weaken this.
Your GPU. No text is generated.
🔬 Run the deep scan free on your own GPU
git clone https://huggingface.co/spaces/coralexbadea/SafetyCard && cd SafetyCard
pip install -r requirements.txt
python -m safetycard.cli scan Qwen/Qwen2.5-1.5B-Instruct --deep --out card.jsonPrefer a web interface? Run python app.py for the full local UI with all three checks. Every deep scan saves a card.json you can share or submit to the leaderboard.
🏆 Leaderboard
Deep-scan cards with real measurements. Add yours by opening a pull request on this Space that adds your card.json to results/.
| Model | File | Parent | Lineage | Weight change | Safety d′ (range) | vs parent |
|---|---|---|---|---|---|---|
| Loading… | ||||||
How accurate is it?
Every score comes with its own controls, so you can tell a signal from noise:
- Held-out scoring. The direction and the layer are chosen on one half of the prompts and scored on the other half.
- Permutation null. The whole procedure is repeated on shuffled labels, which gives the chance level printed on every card.
- Prompt resampling. Each model is measured three times. "Weaker" or "stronger than parent" is reported only when the ranges do not overlap.
Calibration on real models: official Qwen2.5-1.5B-Instruct scores d′ 10.16 (8.80–11.00) against 4.00 for its pretrained base. A community "uncensored" fine-tune of it scores 7.10 (6.59–7.36): weaker than its parent. Lineage: official instruct-tuning changes the weights by 0.010–0.042, while two separately pretrained models of the same architecture measure 1.18.
Built to be safe itself
A scanner that handles untrusted models must not become the attack. SafetyCard loads safetensors only, never unpickles a file, never sets trust_remote_code and generates no text.
FAQ
Is it safe to download a Hugging Face model?
Usually, if the weights are safetensors and the model needs no custom code. That is grade A. Pickle-format files (.bin, .pt, .ckpt) can run arbitrary code when loaded, and so can models that require trust_remote_code. SafetyCard flags both before you download anything.
How can I tell if a model was uncensored or abliterated?
Removing safety training tends to weaken the model's internal harmful-versus-harmless separation. SafetyCard measures that separation against the parent model and reports a difference only when it is clear. Below about 1B parameters the measurement is too noisy, and the card warns you.
Is this model really a fine-tune of the model it claims?
The lineage check compares weights tensor by tensor against the declared base. An unrelated model stands out immediately.
Does SafetyCard detect hidden backdoors?
No, and we will not claim it does. No public tool can currently guarantee that a model is backdoor-free. SafetyCard reports the evidence it can measure reliably.
Is it free?
Yes. The instant scan runs in your browser, and deep scans run on your own hardware. It is open source under Apache-2.0.
Limitations
- A clean card is evidence, not a guarantee. It does not prove that a model is safe or free of hidden behaviours.
- Below about 1B parameters the safety-structure check is too noisy to compare models reliably.
- The safety-structure check needs a parent model as a reference point.
- The prompt sets are public, so a model trained to fool exactly this test could do so.
- Leaderboard cards are self-reported. Each one records the model revision and tool version so anyone can re-run it.