Almost everything written about Hugging Face is out of date, and the stale parts are the parts you copy and paste. Four corrections first, all checked on 15 July 2026:
- Git LFS is no longer the storage backend. Hugging Face bought XetHub in August 2024 and Xet replaced it. LFS is explicitly the legacy path.
- The CLI is
hf, nothuggingface-cli. Login ishf auth login. - transformers is on v5. v5.0.0 shipped 26 January 2026;
load_in_4bitandload_in_8bitare gone. Every pre-2026 tutorial targets v4. - The Open LLM Leaderboard is dead. Retired 13 March 2025. If a model card cites its score, that score points at a benchmark that no longer exists.
Underneath the confusion, Hugging Face is three businesses stacked in a trench coat: a repo host, a pile of libraries, and a compute vendor. Knowing which one you are touching is most of the battle. It also did not start as an ML company. TechCrunch's March 2017 coverage of the launch describes a chatbot app for teenagers, funded partly by the NBA's Kevin Durant. The pivot worked: as of its August 2023 Series D the company raised $235M at a reported $4.5B valuation, still the most recent public round I can find. Treat that as a 2023 datapoint, not a current one.
Business one: the Hub is a git host with a very good blob store
A Hub repo is a git repo where the giant files are pointer files and the real bytes live elsewhere. That model is still right. Only the "elsewhere" changed.
The Hub docs are direct: "Historically, Hub repositories have relied on Git LFS for this mechanism. While Git LFS remains supported... the Hub has adopted Xet, a modern custom storage system built specifically for AI/ML development." The acquisition writeup gives the reason in one line: "Unlike Git LFS, which deduplicates at the file level, Xet-enabled repositories deduplicate at the level of bytes." LFS versions the whole file on any change, as the docs concede; Xet uses content-defined chunking at roughly 64KB per chunk. Tweak a checkpoint, push only the deltas.
Practically: install git-xet, not git-lfs, track files over 10MB with git xet track "*.safetensors", and otherwise do normal git. A Xet repo keeps the LFS pointer format, so a bare clone looks identical and old clients still work; their uploads get migrated in the background.
The versioning answer people actually need: every repo has real git history, and revision accepts a branch, a tag, or a commit SHA. Pinning a SHA is how you stop a model changing under you. The security section will make that uncomfortably concrete.
Business two: the libraries
The useful framing is "which one do I reach for," not "here is a list." Versions verified live against the PyPI and npm registry APIs on 15 July 2026:
| Library | Version | Released | Reach for it when |
|---|---|---|---|
| transformers | 5.14.0 | 2026-07-15 | you want to load, run, or fine-tune a pretrained transformer in Python |
| huggingface_hub | 1.23.0 | 2026-07-09 | you are talking to the Hub itself (download, upload, auth) |
| hf | 1.23.0 | 2026-07-09 | you just want the CLI, standalone |
| datasets | 5.0.0 | 2026-06-05 | data will not fit in RAM, or you want streaming |
| accelerate | 1.14.0 | 2026-06-11 | you have more than one GPU, or want device_map="auto" |
| peft | 0.19.1 | 2026-04-16 | fine-tuning on one consumer GPU (LoRA / QLoRA) |
| trl | 1.8.0 | 2026-07-09 | post-training and alignment (SFT, DPO, GRPO) |
| diffusers | 0.39.0 | 2026-07-03 | image, video, or audio generation, not text |
| safetensors | 0.8.0 | 2026-06-09 | you are saving weights and do not want them to be code |
| sentence-transformers | 5.6.0 | 2026-06-16 | embeddings, retrieval, reranking |
| tokenizers | 0.23.1 | 2026-04-27 | almost never directly; transformers uses it for you |
| @huggingface/transformers (npm) | 4.2.0 | 2026-04-22 | in the browser. This package. |
| @xenova/transformers (npm) | 2.17.2 | 2024-05-29 | never. Renamed and superseded; frozen for two years. |
Note the version numbers doing real work. transformers went to v5 on 26 January 2026, and the release notes list changes that break pasted code: load_in_4bit and load_in_8bit are removed in favour of quantization_config, the default dtype for from_pretrained is now auto so models load in the dtype they were saved in rather than being forced to float32, Python 3.10 is the minimum, encode_plus() gives way to __call__(), use_auth_token gives way to token, and torchscript support is dropped. Separately, since v4.56 the parameter is dtype; torch_dtype still works but warns. huggingface_hub only reached 1.0.0 on 27 October 2025, which is why the CLI rename and the Xet defaults landed together.
Business three: they sell compute
Inference Providers is a routing proxy across third-party providers, not Hugging Face's own GPU pool. The old serverless Inference API survives as exactly one provider named hf-inference, and the docs say so: "This service used to be called 'Inference API (serverless)' prior to Inference Providers." They add that as of July 2025 it "focuses mostly on CPU inference." The free serverless LLM endpoint you remember is gone.
Routing is OpenAI-compatible at https://router.huggingface.co/v1, per the docs, with policy suffixes :fastest (the default), :cheapest and :preferred, or pin a provider outright with openai/gpt-oss-120b:groq. Seventeen providers as of 15 July 2026. That endpoint is chat completions only; embeddings and images go through InferenceClient.
Now the number. The Inference Providers index markets "a generous free tier." The pricing page quantifies it. As of 15 July 2026:
| Account type | Monthly inference credits |
|---|---|
| Free Users | $0.10 (docs add "subject to change") |
| PRO Users | $2.00 |
| Team or Enterprise Organizations | $2.00 per seat, shared |
Ten cents. Both pages are live, both official, and they do not agree in spirit. To Hugging Face's credit the billing is clean: "Hugging Face charges you the same rates as the provider, with no additional fees."
Inference Endpoints is the dedicated deployment product: managed infrastructure, autoscaling, logs and metrics, with "integrated support for open-source Inference Engines: Whether you want to deploy your model with vLLM, TGI or a custom container." Hourly hardware as of 15 July 2026 runs from $0.03 for CPU to $74.00 for the largest B200 config, H100 at $4.50 to $36.00.
Spaces is the demo host. The free tier is, verbatim, "16GB RAM, 2 CPU cores and 50GB of (not persistent) disk space," it sleeps when idle, and only ports 80, 443 and 8080 are reachable. The current config reference lists sdk as "either gradio, docker, or static", so a tutorial offering Streamlit in the create flow is describing an older Hub.
ZeroGPU is the free GPU tier, and the hardware is not what older posts claim. As of 15 July 2026 it is an NVIDIA RTX Pro 6000 Blackwell, not an A100: large is half a card at 48GB VRAM, xlarge the full 96GB. Daily quotas are 2 minutes unauthenticated, 5 on a free account, 40 on PRO or Team, 60 on Enterprise, with paid tiers buying more at $1 per 10 minutes. Gradio SDK only, 60-second default runtime, no torch.compile.
That is the demo-versus-production gap in numbers. A Space that runs beautifully for its author gives an anonymous visitor two minutes of GPU a day at low queue priority. It works until it trends.
Actually starting
Install and authenticate. The device-code flow prints a URL and a short code.
pip install hf
hf auth login
hf auth whoami
hf download gpt2 config.json
The one-liner that makes people fall in love, and its trap:
from transformers import pipeline
pipe = pipeline(task="text-generation", model="google/gemma-2-2b")
pipe("the secret to baking a really good cake is ")
The trap is documented by Hugging Face itself: "Each task is configured to use a default pretrained model and preprocessor, but this can be overridden with the model parameter." Omit model and you silently inherit someone's default. Always name it. Also from the pipeline tutorial: "batch inference is disabled by default," and do not batch if you are latency-constrained, on CPU, or unsure of your sequence length. "The only way to know for sure is to measure performance on your model, data, and hardware."
When you outgrow pipeline, drop to AutoModel and AutoTokenizer, and note that canonical ids are now namespaced: google-bert/bert-base-cased, not bare bert-base-cased. Calling a hosted model instead of downloading one looks like this:
from huggingface_hub import InferenceClient
client = InferenceClient()
completion = client.chat.completions.create(
model="openai/gpt-oss-120b",
messages=[{"role": "user", "content": "How many 'G's in 'huggingface'?"}],
)
print(completion.choices[0].message)
Where your disk went. HF_HOME defaults to ~/.cache/huggingface and holds both your token and the cache. On a small root volume or in a container, move it. The gotcha that eats an afternoon: "All environment variables are read at import time of huggingface_hub. Any modification made afterwards will not be taken into account." Setting os.environ['HF_HOME'] after the import does nothing at all.
export HF_HOME=/mnt/big-disk/hf
export HF_XET_HIGH_PERFORMANCE=1
That second line replaces HF_HUB_ENABLE_HF_TRANSFER, which blogs still recommend and which is deprecated: "Now that the Hugging Face Hub is fully powered by the Xet storage backend... hf_transfer can't be used anymore." For tokens, the docs recommend "using only fine-grained tokens for production usage. The impact, if leaked, will be reduced," plus "one access token per app or usage." Read from HF_TOKEN, never a literal.
"It is on Hugging Face" does not mean "you may use it"
This is the section that costs people money later. I pulled the Hub's own licence facet counts on 15 July 2026. The method matters: the correct facet shape is ?license=license%3A<id>, because the naive ?license=apache-2.0 silently returns 152 instead of 498,665. A three-thousand-fold error that looks exactly like a number.
| Licence identifier | Models | What it actually means |
|---|---|---|
| apache-2.0 | 498,665 | Genuinely open, permissive |
| mit | 181,927 | Genuinely open, permissive |
| other | 109,373 | Unknown. Read the LICENSE file. |
| openrail | 41,350 | RAIL, use restrictions apply |
| creativeml-openrail-m | 32,739 | RAIL, use restrictions apply |
| cc-by-nc-4.0 | 20,253 | Non-commercial. You cannot ship it. |
| openrail++ | 17,337 | RAIL, use restrictions apply |
| gemma | 14,486 | Custom vendor terms (Google) |
| cc-by-4.0 | 14,112 | Open with attribution |
| unknown | 10,799 | No licence declared. Treat as all rights reserved. |
| llama3.1 | 9,168 | Custom vendor licence, 700M MAU gate |
| llama3.2 | 8,096 | Custom vendor licence |
| cc-by-sa-4.0 | 4,003 | Open, share-alike |
| llama3.3 | 2,635 | Custom vendor licence |
| llama4 | 629 | Custom vendor licence plus EU multimodal exclusion |
Live facet queries against huggingface.co/models, 15 July 2026. Counts drift by the hour.
other plus unknown is 120,172 models where you cannot know your rights without opening the repo and reading prose. The Hub's licence list also includes research-only and explicitly non-commercial identifiers. And the field is self-declared metadata picked from a dropdown; nothing verifies it. (That last point is my inference from how the metadata works, not a stated Hugging Face position.)
The Llama 700M clause, and the nuance nearly everyone misses. Llama 3.1 Community License, Section 2: "If, on the Llama 3.1 version release date, the monthly active users of the products or services made available by or for Licensee... is greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta." The threshold is measured on the release date, not the day you start using it. Growing past 700M later does not retroactively trigger it. It is a snapshot test aimed at a handful of named rivals, and Llama 4 uses the identical structure. (Sourcing caveat: llama.com is client-side rendered and meta-llama repos are gated, so I read this from a verbatim mirror.) It is still not open source in any OSI sense: you must "prominently display 'Built with Llama'", prefix derivative model names with "Llama", ship a Notice file, and comply with an Acceptable Use Policy incorporated by reference.
Llama 4 and the EU is the sharpest example on the Hub. That Acceptable Use Policy withholds the Section 1(a) grant for multimodal models from "an individual domiciled in, or a company with a principal place of business in, the European Union," while noting it "does not apply to end users of a product or service that incorporates any such multimodal models." All Llama 4 models are multimodal, so EU-domiciled companies cannot take the grant, while non-EU companies may ship products into the EU. Note the attribution carefully: the clause lives in the AUP, not the licence body, which never mentions the EU at all.
Gemma permits commercial use, but the terms contain a clause production users should read twice: "Google reserves the right to restrict (remotely or otherwise) usage of any of the Gemma Services that Google reasonably believes are in violation of this Agreement." The counterweight, same document: "Google claims no rights in Outputs you generate using Gemma."
Gating is real and enforced. Authors control access individually and "can decide at any time to block your access to the model without prior notice, regardless of approval mechanism or if your request has already been approved." The EU restriction has a metadata counterpart, extra_gated_eu_disallowed: true, with location taken from IP. You can watch gating work in one command. This is an ordinary unauthenticated GET, and it returns 401:
curl -o /dev/null -w '%{http_code}' \
https://huggingface.co/meta-llama/Llama-3.3-70B-Instruct/raw/main/LICENSE
# 401
You cannot read the licence of a gated model without an account and an approved request.
And the quiet one: a model's licence and its training data's licence are separate questions. The card has a license: field for the weights and a datasets: field for training data, each dataset carrying its own terms. Nothing forces them to agree, and nothing forces an author to list datasets at all.
The weights might be code
The default PyTorch checkpoint format is pickle, and pickle runs code. Hugging Face's security docs name the opcodes: "The instructions that pose a threat are STACK_GLOBAL, GLOBAL and REDUCE. REDUCE is what tells the unpickler to execute the function with the provided arguments." Loading a .bin checkpoint is running a program.
safetensors exists for exactly this: "a new simple format for storing tensors safely (as opposed to pickle) and that is still fast (zero-copy)." It has also been audited, which write-ups tend to either skip or assert without a link. Hugging Face, EleutherAI and Stability AI jointly commissioned a Trail of Bits review, published 23 May 2023, whose headline finding was "No critical security flaw leading to arbitrary code execution was found." It did find missing validation allowing polyglot files, since fixed.
Hugging Face scans every uploaded file with ClamAV and a pickle-import scanner that reads opcodes without executing them. Their disclaimer deserves quoting rather than paraphrasing: "this is not 100% foolproof. It is your responsibility as a user to check if something is safe or not. We are not actively auditing python packages for safety."
Then there is trust_remote_code, which deliberately reopens the door safetensors closed. It defaults to False, and the parameter docs are plain: "This option should only be set to True for repositories you trust and in which you have read the code, as it will execute code present on the Hub on your local machine." The risk is dynamic. Reviewing the code today does not bind the repo tomorrow unless you pin revision to a commit SHA. That is the second time pinning has come up, and it is the most underrated habit on the platform.
The leaderboard is dead, long live the benchmark
The Open LLM Leaderboard was, for two years, how people picked models. It is gone, and there were two events people conflate. v1 was archived in June 2024 and replaced by v2. Then v2 was retired entirely on 13 March 2025. Before you dismiss it: over 2 million unique visitors in its final ten months, roughly 300,000 monthly active community members, and 13,000-plus models scored across six benchmarks via the EleutherAI harness (ARC, HellaSwag, MMLU, TruthfulQA, Winogrande, GSM8k).
Hugging Face's own retirement note is the most quotable line in this piece. Benchmarks, they wrote, "could encourage people to hill climb irrelevant directions in the field." That is the platform conceding the leaderboard-gaming problem in its own words. There is no direct replacement.
Contrast MTEB, the embeddings leaderboard, which is alive. The MMTEB paper describes "over 500 quality-controlled evaluation tasks across 250+ languages," and reports a finding that should kill the reflex of grabbing whatever sits on top: multilingual-e5-large-instruct, at 560 million parameters, was the best-performing publicly available model, beating much larger LLMs on subsets. Small and well-fitted wins. I am not naming a current number one, because the live leaderboard is JS-rendered and I could not read it.
The honest critique
Centralisation. As of 15 July 2026 the Hub hosts 2,913,168 models, 957,683 datasets, and 1,420,556 Spaces. (The licence table totals 2,913,111 because I pulled it minutes earlier. That gap is the growth rate.) One privately held company, last independently valued in 2023, hosts essentially the entire open-ML ecosystem's weights for free, and huggingface.co is the hardcoded default download endpoint in transformers, diffusers, datasets, sentence-transformers, transformers.js and countless CI pipelines. There is no widely used mirror. That is not a criticism of anyone's conduct. It is a single point of failure nobody chose deliberately.
The Hub is an attic, not a shop. Nearly three million models, no curation, and no requirement that a model card say anything, because the card is just a README. Eval results in model-index metadata are self-reported, and Hugging Face's own documented example shows a score sourced to the now-retired Open LLM Leaderboard. The official GGUF docs still use a TheBloke repo as their canonical example, and @xenova/transformers still pulls traffic two years after the rename. Old things do not get swept out; they just stop moving.
Two things help you navigate it. base_model records whether something is a finetune, adapter, quantization, or merge, and the Hub infers the relationship, so you can trace a random 7B upload to its origin. And the GGUF quantization decoder is worth memorising: Q4_K is 4.5 bits per weight and the usual sweet spot, Q6_K is 6.5625, Q2_K is 2.625 and aggressive, and anything named Q4_0 or Q5_0 is what the docs call a "Legacy quantization method (not used widely as of today)."
Free has edges, and they are published. Rate limits as of 15 July 2026 run over 5-minute fixed windows: free accounts get 1,000 API requests, 5,000 resolver requests, and 200 page requests per window, plus 100GB private storage and 8 concurrent CPU Spaces. Generous for a person, thin for a pipeline.
Which is the moment to say how I got the counts above: plain GETs against public listing pages, a couple of dozen requests, nowhere near that 200-pages ceiling, no authentication and nothing gated. When you pull numbers off anyone's site, that is the shape it should take. Keep an explicit allow-list of origins, so a bug cannot wander onto hosts you never intended. Rate-limit yourself below the published ceiling rather than at it. Cache, so a re-run costs them nothing. Set timeouts. Treat robots.txt and the terms as requirements you code against, not a line in a footer. The 401 above is a restriction I documented, not one I worked around, and that distinction is the whole game.
Paid tiers, all as of 15 July 2026: PRO $9/month, Team $20/month per user, Enterprise from $50/month per user, plus an Enterprise Plus tier at custom pricing that appears in the docs but not on the pricing page. Hub storage is $12/TB/month public and $18 private at base rates, dropping to $8/$12 above 500TB. The page benchmarks that against AWS S3 at $23 and Backblaze Overdrive at $15.
What to take away
Hugging Face is the best thing that happened to open ML and also one company's free service that everyone's build silently depends on. Use it accordingly. Name your model instead of taking pipeline defaults. Pin a commit SHA. Prefer safetensors, and leave trust_remote_code alone unless you have read the code at the revision you pinned. Read the LICENSE before you ship, especially for the 120,172 models whose metadata refuses to tell you anything. And check the version of whatever tutorial you are following, because the field rewrote its own API in January and the internet has not noticed yet.
If you want the broader argument about building real things on cheap, free-tier infrastructure without waking up owned by it, that is most of what The $97 Launch is about.
Related reading
- Gemma: Google's Open-Weights Family, And Where It Fits Next To Qwen: the model family whose terms let Google restrict usage remotely
- Qwen: When It's The Right Model And How To Run It At Home: what to do with the weights once you have downloaded them
- When the Built-in LLM Won't Reach: Transformers.js and the browser path off the Hub
- The Vector Database You Were About to Buy Is a For Loop: where a small sentence-transformers model earns its keep
- Nation-State Malware, Protestware, and the Packages Your AI Pulls In: the same trust problem, one layer down the stack
Fact-check notes and sources
- Xet replaced Git LFS: Xet storage backend, history and byte-level dedup, LFS as legacy, 64KB chunking, git-xet workflow.
- CLI rename to
hf: huggingface_hub CLI guide; standalone package version via the PyPI JSON API, queried 2026-07-15. - transformers v5 breaking changes: v5.0.0 release notes. The
torch_dtypetodtyperename landed in v4.56 and still warns rather than fails, per modeling_utils.py at v5.14.0. Version dates from the GitHub Releases API and PyPI, queried 2026-07-15. - Inference Providers pricing and the $0.10 free tier: Pricing and Billing; routing, policies and partner list at the Inference Providers index. Account and hardware pricing at huggingface.co/pricing. All read 2026-07-15.
- Spaces and ZeroGPU: Spaces Overview, Spaces config reference, ZeroGPU. Rate limits and plan tiers at Team & Enterprise plans.
- Licence counts: live facet queries against huggingface.co/models, 2026-07-15, using the
?license=license%3A<id>URL shape. Supported identifier list at Hub Licenses. - Llama terms: Llama 3.1 Community License via a verbatim mirror; Llama 4 Community License and Acceptable Use Policy via an ungated copy. Meta's llama.com licence pages are client-side rendered and
meta-llamarepos are gated, so these are third-party redistributions rather than Meta's own pages; verify in a browser before relying on them commercially. Llama 3.3's threshold is not independently verified here. - Gemma terms: Gemma Terms of Use.
- Gating: Gated models. The 401 reproduces live against the Llama 3.3 LICENSE path.
- Pickle and safetensors: Pickle Scanning, safetensors README, Trail of Bits audit writeup (2023-05-23).
trust_remote_codedocumentation at Auto Classes. - Leaderboards: Open LLM Leaderboard v1 archive, retirement announcement, 2025-03-13, MMTEB paper, MTEB repo.
- Origin and funding: TechCrunch, 2017-03-09 for the original chatbot product; IBM newsroom, 2023-08-24 for the $235M Series D. The $4.5B valuation and Salesforce Ventures lead are trade-press reported, not in the primary release. No later round has been announced as of 2026-07-15; aggregator sites carrying a larger, more recent figure do not survive scrutiny.
- Model cards, GGUF, environment variables, tokens: Model Cards, GGUF, environment variables, access tokens, pipeline tutorial.
This post is informational, not legal or engineering advice. Mentions of Hugging Face, Meta, Google, and other third parties are nominative fair use, and I have no affiliation with any product or organization named. Prices, quotas, tier limits, and library versions are current as of mid-2026 and change quickly; verify against the live docs before you build.
