Back to glossary

Term

Safetensors

Safetensors is a file format developed by Hugging Face for storing model weights — faster, safer and more language-agnostic than the older PyTorch `.pt`/`.bin` format.

Safetensors — explained in more detail

The classic PyTorch format stores tensors via Python’s pickle module. pickle can execute arbitrary Python code on load — meaning a downloaded model file could theoretically compromise the host system. Safetensors fixes this with a strict, header-based binary format: a JSON header describes tensor names, data types and shapes, followed by raw bytes. No code path, no code execution. The format also enables memory-mapped loading: weights are not read into RAM first but mapped directly from the file into GPU memory, which significantly reduces load times for large models.

Example / Practical context

Today, almost every current model on Hugging Face ships safetensors files (.safetensors) by default — often alongside a legacy .bin file for older toolchains. Inference servers such as vLLM and TGI prefer safetensors as input, because mapping a 70B model into GPU memory on start-up takes seconds rather than minutes. Training pipelines also save adapters and checkpoints in safetensors form.

PyTorch .pt/.bin (pickle) is the older standard format — flexible but unsafe when loading untrusted files. GGUF is a quantised format specific to the llama.cpp family, optimised for CPU inference and including embedded tokenizer data. ONNX is a framework-agnostic interchange format for inference optimisation. Safetensors covers the “safe, fast weight serialisation in the PyTorch ecosystem” niche.

Entdecke mehr