Are local LLMs safe?

While the model runs on your own PC, text generation happens inside your PC. What you type is not sent to the model's developer. This is because the model file (GGUF) is weight data and does not communicate over the network by itself.

What communicates is the features of the app you use. Downloading models, checking for app updates, web search, and connecting to external services all use the internet. If you are concerned, check the app's settings and documentation to see which features communicate.

GGUF, the format this site covers, holds only weights (arrays of numbers) and configuration, and has no mechanism that runs a program inside the file when it is loaded. safetensors, used on Hugging Face, is likewise a format that holds only data.

What needs care is older formats that use Python's pickle (many files with the extensions .bin, .pt, .pth, or .ckpt). When they are loaded, a program planted in the file can be executed. If you only use GGUF with llama.cpp, Ollama, or LM Studio, you will not handle these formats.

GGUF itself contains no program code, but vulnerabilities in which a crafted GGUF file exploits bugs in the loading software have been reported in the past.

• • February 2024: memory corruption when llama.cpp loads GGUF (Cisco Talos report TALOS-2024-1912, CVE-2024-21825, and others)
• • March 2026: memory corruption caused by an overflow when calculating tensor sizes (CVE-2026-33298; fixed in llama.cpp b7824)

All of these have been fixed, but you remain affected if you keep using an old version. Use the latest versions of llama.cpp, Ollama, and LM Studio, and be especially careful with files from distributors you do not know. The latest version is also needed to load models in newer formats (each model page lists the version from which upstream llama.cpp can load it).

GGUF files of the same model are distributed by many people and companies. On each model page, we show one of the following categories for each distributor (decided solely by the fact of which Hugging Face account it is).

Published by the original developer

The account that publishes the original model also distributes the GGUF (e.g., Qwen's GGUF distributed by Qwen).

Converted by the llama.cpp developers

Converted and distributed by the ggml-org account, which develops llama.cpp.

Converted and published by a third party

A person or company other than the original developer has converted the original model to GGUF and distributes it. Some of these distributors are widely used, but the original developer does not vouch for the contents of the files.

On the Hugging Face page, you can check the original model (shown as base_model), the download count, and the file update history. If in doubt, choose files from the original developer or from a widely used distributor.

Models whose names include abliterated, uncensored, heretic, or similar terms indicate that they have been modified to weaken or remove the original model's "mechanism for refusing requests such as dangerous ones". Model pages label them "Modified version (name includes abliterated etc.)".

Because they answer instead of refusing, they may also produce incorrect or harmful content. The method and extent of the modification vary by distributor and are outside the scope of the original developer's evaluations. If you use one, be careful how you handle its output.

Most worries such as "Models from this country or this company might be dangerous" concern what you type into the official app or cloud API being sent to and stored on that company's servers. When you run the model on your own PC, what you type is not sent to that company (see section 1).

On the other hand, the content of the model's answers (such as declining to answer on some topics, or bias) is determined by how it was trained, and does not change when you run it locally. This is a property of each model, so check for yourself whether it suits your purpose.