Safetensors

Loading a pickled PyTorch checkpoint can execute arbitrary code, which makes sharing model weights a genuine attack surface. Safetensors, from Hugging Face, replaces pickle with a purpose-built format that cannot run code on load: a file holds an 8-byte header length, a JSON block describing each tensor's dtype, shape, and byte offsets, and then a raw little-endian data buffer. The layout enables memory-mapped, zero-copy style reads and lazy loading of individual tensors without scanning the whole file; the README cites loading BLOOM across 8 GPUs dropping from 10 minutes to 45 seconds compared with standard PyTorch loading. The format also forbids overlapping tensor regions, closing off a class of denial-of-service tricks. Implementations exist in Python and Rust, and safetensors is now the default weight format across the Hugging Face Hub, used by practitioners anywhere untrusted models are downloaded or large models need fast startup. Apache 2.0 licensed.