.PKL

Introduction

Pickle is Python’s own format for saving objects: almost any Python value, from a list of numbers to a trained model, can be written to a file with the pickle module and read back later. Files are usually named .pkl or .pickle. Many machine learning libraries save models this way, and PyTorch checkpoints contain pickles.

A pickle is a small program for a stack machine that rebuilds the objects, and it can call any Python function while doing so. Loading a pickle from an untrusted source can therefore run any code on the computer. Only load pickles you trust.

Structure

A pickle is a sequence of one-byte opcodes, some followed by arguments, that push values onto a stack, build lists, dictionaries and objects from them, and store them in a memo so they can be shared. The last opcode is STOP, the byte 2E (.).

There are six protocol versions, 0 to 5. Protocol 0 is printable text; the later ones are binary. From protocol 2, the file starts with the PROTO opcode 80 followed by the protocol number, so most pickles begin 80 02 to 80 05. Protocol 4 and later group the opcodes into frames, each started by the opcode 95 and an 8-byte length.

Links