convert : explicitly disable trust_remote_code for AutoConfig (#13246)

diff --git a/convert_hf_to_gguf.py b/convert_hf_to_gguf.py
index 04ca646b503cab7974053367f9066dbf79c10a7f..df3f8a55d5320cffd95a31cc71f65d66b9480eb6 100755 (executable)
--- a/convert_hf_to_gguf.py
+++ b/convert_hf_to_gguf.py
@@ -419,7 +419,9 @@ class ModelBase:
     @staticmethod
     def load_hparams(dir_model: Path):
         try:
-            return AutoConfig.from_pretrained(dir_model).to_dict()
+            # for security reason, we don't allow loading remote code by default
+            # if a model need remote code, we will fallback to config.json
+            return AutoConfig.from_pretrained(dir_model, trust_remote_code=False).to_dict()
         except Exception as e:
             logger.warning(f"Failed to load model config from {dir_model}: {e}")
             logger.warning("Trying to load config.json instead")