Update trust_remote_code (#2256)

This pull request improves the handling of the `trust_remote_code` (or
`hf_remote`) option when loading models from Hugging Face repositories,
making the default behavior more secure and ensuring users must
explicitly opt in to executing remote code. It also updates
documentation and adds warnings to inform users about the security
implications.

**Security and behavior changes:**

* Changed the default for `hf_remote`/`trust_remote_code` to `False` in
both `builder.py` and `base.py`, so arbitrary code from Hugging Face
repositories is never executed unless the user explicitly enables it.
This matches the default behavior in the `transformers` library.
[[1]](diffhunk://#diff-11d14636083c4529597f09601b8f66e5df0094978debab425bfe6dd850cfcb50L199-R214)
[[2]](diffhunk://#diff-8a33668cd8981709ba426dab1b3d3145bd0756d1ebf1203657ba8b8aae860d45L89-R103)
* Added warnings in both `builder.py` and `base.py` to clearly notify
users when they have enabled `hf_remote`/`trust_remote_code` and explain
the associated security risks.
[[1]](diffhunk://#diff-11d14636083c4529597f09601b8f66e5df0094978debab425bfe6dd850cfcb50L199-R214)
[[2]](diffhunk://#diff-8a33668cd8981709ba426dab1b3d3145bd0756d1ebf1203657ba8b8aae860d45L89-R103)

**User interface and argument handling:**

* Added a `--trust_remote_code` command-line argument to
`awq-quantized-model.py`, and ensured this option is only forwarded to
model/tokenizer loading if the user has explicitly set it.
[[1]](diffhunk://#diff-a2b2e6bb32d7bd2dbfd980b04d4de97851bf0f12108a1be09a0c880cb68567efR49-R59)
[[2]](diffhunk://#diff-a2b2e6bb32d7bd2dbfd980b04d4de97851bf0f12108a1be09a0c880cb68567efL58-R71)
[[3]](diffhunk://#diff-a2b2e6bb32d7bd2dbfd980b04d4de97851bf0f12108a1be09a0c880cb68567efR153)
* Updated the help text for `hf_remote` in argument parsing to clarify
the new default and the security implications.

**Documentation updates:**

* Updated the documentation in `README.md` to accurately describe the
new default (`hf_remote=false`) and the risks of enabling remote code
execution.

Author: apsonawane

examples/python/awq-quantized-model.py

@@ -46,6 +46,17 @@ def parse_args():
         help="Use the QDQ decomposition for quantized MatMul instead of the MatMulNBits operator",
     )
 
+    parser.add_argument(
+        "--trust_remote_code",
+        action="store_true",
+        help=(
+            "Allow loading custom Python code shipped inside the Hugging Face repository "
+            "during tokenizer load (and forward `hf_remote=true` to the ONNX model "
+            "builder). This is equivalent to running arbitrary code from that repository "
+            "as the current user and should only be enabled for repositories you fully trust."
+        ),
+    )
+
     args = parser.parse_args()
     return args
 
@@ -55,7 +66,9 @@ def quantize_model(args):
 
     # Load model
     model = AutoAWQForCausalLM.from_pretrained(args.model_path, low_cpu_mem_usage=True, use_cache=False)
-    tokenizer = AutoTokenizer.from_pretrained(args.model_path, trust_remote_code=True)
+    # `trust_remote_code` is opt-in: forwarding True without explicit user consent would
+    # cause arbitrary Python shipped inside the repository to execute during tokenizer load.
+    tokenizer = AutoTokenizer.from_pretrained(args.model_path, trust_remote_code=args.trust_remote_code)
 
     # Quantize model
     model.quantize(tokenizer, quant_config=quant_config)
@@ -137,6 +150,7 @@ def main():
 
     extra_options = {
         "use_qdq": args.use_qdq,
+        "hf_remote": args.trust_remote_code,
     }
 
     create_model(model_name, input_folder, output_folder, precision, execution_provider, cache_dir, **extra_options)

src/python/py/models/README.md

@@ -207,14 +207,14 @@ python builder.py -m model_name -o path_to_output_folder -p precision -e executi
 
 #### Hugging Face Remote Code
 
-This scenario is for when you need to disable trusting remote code from a Hugging Face repo.
+This scenario is for when you need to enable trusting remote code from a Hugging Face repo. The default is `hf_remote=false`, which means `trust_remote_code=False` is used for `transformers.*.from_pretrained()` calls and any Python code shipped inside the repository (referenced by its `auto_map` field) will **not** be executed. Set `hf_remote=true` only for repositories you fully trust, because doing so is equivalent to running arbitrary code from that repository as the current user.
 
 ```bash
 # From wheel:
-python -m onnxruntime_genai.models.builder -m model_name -o path_to_output_folder -p precision -e execution_provider -c cache_dir_for_hf_files --extra_options hf_remote=false
+python -m onnxruntime_genai.models.builder -m model_name -o path_to_output_folder -p precision -e execution_provider -c cache_dir_for_hf_files --extra_options hf_remote=true
 
 # From source:
-python builder.py -m model_name -o path_to_output_folder -p precision -e execution_provider -c cache_dir_for_hf_files --extra_options hf_remote=false
+python builder.py -m model_name -o path_to_output_folder -p precision -e execution_provider -c cache_dir_for_hf_files --extra_options hf_remote=true
 ```
 
 #### Exclude Embedding Layer

src/python/py/models/builder.py

@@ -196,7 +196,11 @@ def create_model(
     extra_kwargs = {} if os.path.isdir(input_path) else {"cache_dir": cache_dir}
     hf_name = input_path if os.path.isdir(input_path) else model_name
     hf_token = extra_options.get("hf_token", True)
-    hf_remote = extra_options.get("hf_remote", True)
+    # Default to False so we never execute arbitrary code shipped inside a
+    # Hugging Face repository unless the user has explicitly opted in. This
+    # matches the safe default that `transformers` itself uses for
+    # `trust_remote_code`.
+    hf_remote = extra_options.get("hf_remote", False)
 
     config = AutoConfig.from_pretrained(hf_name, token=hf_token, trust_remote_code=hf_remote, **extra_kwargs)
     if "adapter_path" in extra_options:
@@ -449,7 +453,12 @@ def get_args():
                     If token, you can provide a custom authentication token that differs from the one stored in your environment.
                     If you have already authenticated via `huggingface-cli login`, you do not need to use this flag because Hugging Face has already stored your authentication token for you.
                 hf_remote = Use this to manage trusting remote code in Hugging Face repos.
-                    Default behavior is set to true. If false, remote code stored in Hugging Face repos will not be used.
+                    Default behavior is set to false. When false, transformers `from_pretrained()`
+                    calls will refuse to import or execute custom Python code shipped inside
+                    a Hugging Face repository (`trust_remote_code=False`).
+                    Set to true to opt in to executing repository-supplied code; only do this
+                    for repositories you fully trust because it is equivalent to running
+                    arbitrary code from that repository as the current user.
                 exclude_embeds = Remove embedding layer from your ONNX model.
                     Use this option when you want to remove the embedding layer from within your ONNX model.
                     Instead of `input_ids`, you will have `inputs_embeds` as the input to your ONNX model.

src/python/py/models/builders/base.py

@@ -86,7 +86,11 @@ def __init__(self, config, io_dtype, onnx_dtype, ep, cache_dir, extra_options):
         self.cache_dir = cache_dir
         self.filename = extra_options.get("filename", "model.onnx")
         self.hf_token = extra_options.get("hf_token", True)
-        self.hf_remote = extra_options.get("hf_remote", True)
+        # Default to False so transformers `from_pretrained()` calls do not
+        # execute arbitrary Python from a Hugging Face repository unless the
+        # caller has explicitly opted in via `hf_remote=true` in
+        # `--extra_options`. See the security note in builder.py.
+        self.hf_remote = extra_options.get("hf_remote", False)
         self.extra_options = extra_options
 
         # States for building the model