Safetensors is a file format that stores tensors and a small header, with no mechanism to run code on load, which removes the pickle code execution risk. It does not tell you who made the weights, whether they were tampered with, or whether the model behaves well. Those need other controls.
What the format is
The project describes safetensors as a simple, safe way to store and distribute tensors, designed to be safer than pickle, which it describes as unsafe because it runs arbitrary code. It is also designed to be fast, with zero-copy loading and the ability to load only part of the tensors, which helps when a model is split across several GPUs.
The Hugging Face docs call it a recommended model format for the Hub.
What it protects against
The core gain is that loading a safetensors file does not execute attacker supplied code. A pickle file is a program for the unpickler. A safetensors file is a header describing tensors plus the raw tensor bytes. There is nothing for a loader to call.
The repository also notes a header size limit of 100MB, in place to avoid parsing extremely large JSON. That is a small example of the format being designed to be parsed defensively.
What it does not protect against
- Tampered or poisoned weights. A malicious author can publish perfectly valid safetensors with weights that were trained to misbehave. The format cannot see intent.
- Wrong source. A look-alike repository can serve valid files. Nothing in the file proves who published it.
- Code around the weights. A model repository can include other files, and loading some models needs custom Python. See the trust_remote_code post linked below.
- Licence and provenance problems. The format carries tensors, not legal rights.
I also could not find a statement of an independent security audit on the page I read, so do not claim one for the format unless you verify it yourself.
How to use it well
- Prefer safetensors files over pickle based ones whenever a repository offers both.
- Pin the repository revision you reviewed, so the file cannot be swapped later.
- Record the file hash in your own inventory.
- Keep the loading library patched, since the parser is software too.
Related: pin a model revision to a commit hash and trust_remote_code explained.
A worked example
Say a team downloads a popular model and sees both a pytorch_model.bin and a model.safetensors in the repository. The safer move is to load only the safetensors file. But the team should still note the commit hash, read the model card, and check whether the repository asks for custom code. The format choice removed one risk. Three questions remain: who published it, did the files change since the review, and does the model do what the card says. Each has its own control, and none of them is the file format.
Quick check
If a model is in safetensors, can I skip reviewing where it came from?
No. The format removes one class of risk, code execution on load. Source, integrity and behaviour still need checking.
Does safetensors make torch.load unnecessary?
For weights, mostly yes, since you can load the tensors with the safetensors library. Some projects still ship pickle based checkpoints, so you may meet both.
Sources
- Safetensors documentation
- safetensors repository
- Pickle Scanning, Hugging Face Hub documentation
- GGUF, Hugging Face Hub documentation
Last reviewed: 19 October 2026.
