Prefer safetensors when a model is published in both formats. Safetensors stores only tensors and metadata, while pickle can run code when loaded. Hugging Face describes safetensors as a format for storing tensors safely, as opposed to pickle, and the Transformers library loads it first when it is available.
The difference in one table
| Question | Pickle based checkpoint | Safetensors |
|---|---|---|
| What does it hold? | Any Python object | Tensors, plus header metadata |
| Can loading run code? | Yes, by design | The format has no code instructions |
| Typical extension | .bin, .pt, .pth, .pkl | .safetensors |
| Partial loading | Not the usual path | Supported, you can read a slice of a tensor |
| Still need to trust the source? | Absolutely | Yes, for the rest of the repo |
The last row matters most. Switching format shrinks one risk. It does not make a repository trustworthy.
What Transformers does for you
The Transformers documentation says from_pretrained loads weights stored in the safetensors format if they are available. It also says that traditionally PyTorch weights are serialized with pickle, which is known to be insecure, and that safetensors files are more secure and faster to load.
That default is helpful, but it only helps if the repo contains a safetensors file. If it does not, the library may fall back to what exists. Check which file your code is actually reading.
An order of preference
- A safetensors file from a publisher you can name.
- A pickle checkpoint from a publisher you can name, loaded with weights_only=True and a recorded hash.
- A pickle checkpoint of unknown origin: avoid, or open only inside an isolated sandbox.
Converting your own models
If your team trains models, save them as safetensors as well. It costs a few lines.
from safetensors.torch import save_file
save_file(model.state_dict(), "model.safetensors")
Anyone downstream then has a choice that does not require running your pickle. This is a small change that helps every consumer of your artifacts.
What safetensors does not solve
A model repository can contain more than weights. It may include custom modeling code, tokenizer files, configuration and example scripts. If you pass trust_remote_code=True, you are running that code. Our post on what trust_remote_code really does walks through it.
Safetensors also says nothing about whether the weights were trained or tampered with in a way that changes behavior. It is a safe container, not a statement about content.
Where Safeguard fits
Safeguard covers the code side of an ML project: SBOM and dependency scanning, reachability analysis and policy gates in pull requests. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is a .safetensors file always safe to download?
The file format cannot execute code on load, but the repository around it can contain other files. Review those and confirm the publisher.
Do I need to change my training code to use safetensors?
Usually only the save call. Libraries such as Transformers already read it when present.
Sources
Last reviewed: 19 October 2026.
