Before a trained model can be deployed anywhere, it has to be serialized — saved to a file that can be reloaded later, in a different process, on a different machine, without retraining.
The Two Main Options
| joblib | pickle | |
|---|---|---|
| Best for | scikit-learn models and NumPy-array-heavy objects | General-purpose Python objects |
| Efficiency on large arrays | More efficient — optimized for NumPy data | Less efficient for large arrays |
| scikit-learn's own recommendation | Yes, for their models specifically | Works, but not the optimized choice |
Minimal Working Example
import joblib
from sklearn.ensemble import RandomForestClassifier
model = RandomForestClassifier(n_estimators=200, random_state=42)
model.fit(X_train, y_train)
joblib.dump(model, "model.pkl") # save
loaded_model = joblib.load("model.pkl") # load, in this or a different process
print(loaded_model.predict(X_test[:5]))The Critical Security Warning
Never load a joblib or pickle file from an untrusted source. Both formats can execute arbitrary Python code during deserialization — a maliciously crafted file, disguised as an innocent model, can run any code the attacker chooses the instant it's loaded. See Pickle for ML for the full technical explanation of exactly how this attack works, and how to defend against it.
What to Actually Save — More Than Just the Model
# Save the FULL fitted pipeline (preprocessing + model), not just the classifier --
# see Model Training Pipeline for why this matters
joblib.dump(full_pipeline, "pipeline.pkl")
# Also worth saving alongside the model:
metadata = {
"model_version": "1.2.0",
"training_date": "2026-08-01",
"feature_names": list(X_train.columns),
"sklearn_version": sklearn.__version__, # environment mismatches are a real deployment failure mode
}
import json
with open("model_metadata.json", "w") as f:
json.dump(metadata, f)Recording the exact library versions used at training time is genuinely important — a model saved with one scikit-learn version can sometimes fail to load, or silently behave differently, under a different version in production.
Practical Use Cases
- Every deployed model, without exception — this is the mandatory first step of any deployment path
Common Mistakes
- Saving only the raw model object, discarding the preprocessing pipeline that must run before it.
- Loading a model file from an untrusted or unverified source — see the security warning above.
- Not tracking which library versions a saved model depends on, causing mysterious failures when the deployment environment differs from the training environment.
Interview Relevance
Q: "What's the security risk of loading a pickle or joblib file from an unknown source?" Both formats can execute arbitrary code during deserialization — an attacker can craft a file that looks like a normal model but runs malicious code the moment it's loaded; never unpickle a file you don't fully trust the origin of.
Practice Question
A teammate wants to load a "pretrained model" file downloaded from an unfamiliar forum post to save training time. What would you tell them, and why?
