What Are Safetensors?
Safetensors is a secure, fast file format for storing and distributing machine learning model weights without the risk of arbitrary code execution. Unlike legacy formats such as Python's pickle, which can embed executable code inside serialized files, Safetensors stores only raw tensor data and metadata—making it immune to deserialization attacks that have plagued the ML ecosystem for years.
Why It Matters
Model weight files are shared millions of times across platforms like Hugging Face Hub, and a single malicious pickle file can compromise an entire training pipeline or production server. Safetensors eliminates this attack surface entirely by design. In April 2026, Safetensors moved from Hugging Face to the PyTorch Foundation under the Linux Foundation, cementing its position as the vendor-neutral industry standard for model serialization.
This governance shift matters because it paves the way for Safetensors to become the default serialization format within PyTorch core itself—not just a third-party add-on.
How It Works
Safetensors uses a simple binary format with a JSON header followed by raw tensor data:
- Header: A small JSON object mapping tensor names to their data types, shapes, and byte offsets
- Data section: Contiguous raw bytes for each tensor, with no executable code
- Memory mapping: Files can be memory-mapped directly, enabling zero-copy loading that is significantly faster than pickle-based alternatives
Because the format supports direct memory mapping, it enables advanced features like device-aware loading (straight to GPU) and pipeline-parallel loading for models with hundreds of billions of parameters.
Example
Loading a model with Safetensors in Python:
1 from safetensors.torch import load_file 2 tensors = load_file("model.safetensors") # zero-copy, no code execution risk
Compare this to the legacy approach where torch.load("model.pt") uses pickle under the hood—which can execute arbitrary Python code embedded by an attacker.
Safetensors intersects with quantization (quantized weights still need safe serialization), fine-tuning (LoRA adapters are commonly distributed as Safetensors files), and the broader open-source AI ecosystem where secure model distribution is critical for trust.