Safetensors documentation

What safetensors is

Model weights have to be saved to a file and loaded again. For years the default in PyTorch was Python's pickle format. Pickle is flexible because it can rebuild any Python object, and that flexibility is the problem: loading a pickle file can run code chosen by whoever made the file. Hugging Face's own security documentation says plainly that arbitrary code execution attacks are possible when you load a pickle file, and advises loading only from people and organisations you trust.

Safetensors is the answer Hugging Face built: a simple format that stores tensors (the arrays of numbers that make up weights) and a small header describing them, and nothing else. Because there is no way to express code in the file, loading it does not run code. It is also fast, supports zero-copy loading and lets you load only part of a model, which helps on machines with several GPUs.

Who uses it

It is now the default format for many projects. The documentation lists users such as Hugging Face Transformers and Diffusers, Apple's MLX, llama.cpp's conversion tools, ComfyUI and many more. On the Hugging Face Hub you will see .safetensors files next to, or instead of, older .bin files.

Is it worth your time?

For anyone securing AI systems, yes, and it takes about an hour. The AI supply chain is one of the OWASP Top 10 risks for LLM applications, and unsafe model files are its most concrete example. Knowing the difference between a pickle-based checkpoint and a safetensors file, and how to load the safe one, is basic hygiene.

How to use it well

• Prefer models that ship .safetensors weights, and check what format your tools load by default.
• When a model only offers pickle-based files, load it first in an isolated environment with no credentials, and look at the import list the Hugging Face Hub shows for pickled files.
• Convert models you control to safetensors and keep the original out of production.
• Remember that a safe file format does not make the model's behaviour safe: a poisoned model can still be stored in safetensors. Check provenance too.

Free or paid?

Free and open source, installed with pip or conda.