safetensors
In plain wordsA file format for storing an AI model's learned numbers that cannot hide harmful programs and loads very quickly, replacing older formats that could run code when opened.
A file format and accompanying library, created by Hugging FaceHugging Face, prop. n.: A company whose website is the main public library for sharing AI models and datasets — often called the GitHub of machine learning — and which makes widely used free AI software., for distributing tensors such as model weightsweights, n.: The learned numbers inside a neural network that set how strongly each part influences the next. The finished set of weights is, in effect, the trained model itself. without the code-execution risk of older formats and without giving up loading speed. A file consists of an eight-byte length field, a JSON header listing each tensor's name, data type, shape and byte offsets (plus optional metadata), and a flat block of raw tensor data. Because the format holds only data and no executable instructions, loading a file cannot run code — unlike PyTorch's earlier default of Python pickle serialization, in which a crafted checkpointcheckpoint, n.: A saved snapshot of a model partway through or at the end of training, like a save point in a video game: training can resume from it after a crash, and finished snapshots are what people download and run. could execute arbitrary commands on the machine that loads it. The simple layout also allows memory-mapping and lazy loading of individual tensors, which speeds the loading of large models and lets them be split across devices without reading whole files. Safetensors became the default weight format on the Hugging Face Hub and in many frameworks; it stores tensors only, so tokenizers and configuration travel in separate files.
Only download checkpoints in safetensors format; the pickle files in that repository could run code on load.
Origin
Created at Hugging Face in 2022, principally by Nicolas Patry, in response to the security risks of pickle-based checkpoints. After an external security audit by Trail of Bits in 2023, commissioned together with EleutherAI and Stability AI, Hugging Face made it the default format for saving models in its libraries.
Usage note
Safe loading is not the same as a safe model: a safetensors file can still contain backdooredbackdoor attack, n.: Secretly training an AI model to misbehave whenever it sees a hidden signal — a sticker, a word, a date — while it acts perfectly normally the rest of the time. or otherwise harmful weights. GGUFGGUF, abbr.: A file format that packs an AI language model, often in a shrunken low-precision version, into one file that ordinary computers can load and run quickly; used by llama.cpp and Ollama. plays a similar role for quantized models run locally.
Related
- Hugging FaceHugging Face, prop. n.: A company whose website is the main public library for sharing AI models and datasets — often called the GitHub of machine learning — and which makes widely used free AI software.
- PyTorchPyTorch, prop. n.: The most widely used free software toolkit for building and training neural networks, especially in research; programmers write ordinary Python and it handles the calculus and the graphics chips.
- GGUFGGUF, abbr.: A file format that packs an AI language model, often in a shrunken low-precision version, into one file that ordinary computers can load and run quickly; used by llama.cpp and Ollama.
- weightsweights, n.: The learned numbers inside a neural network that set how strongly each part influences the next. The finished set of weights is, in effect, the trained model itself.
- checkpointcheckpoint, n.: A saved snapshot of a model partway through or at the end of training, like a save point in a video game: training can resume from it after a crash, and finished snapshots are what people download and run.
- ONNXONNX, prop. n.: A shared file format for trained AI models, so that a model built with one toolkit can be moved to and run by another, much as a PDF opens on any computer.
Mentioned in
Hugging FaceHugging Face, prop. n.: A company whose website is the main public library for sharing AI models and datasets — often called the GitHub of machine learning — and which makes widely used free AI software., AI supply chain securityAI supply chain security, n.: Protecting everything an AI system is built from — downloaded models, datasets, code libraries and tools — against tampering, so a poisoned or fake part cannot sneak into the finished product., weightsweights, n.: The learned numbers inside a neural network that set how strongly each part influences the next. The finished set of weights is, in effect, the trained model itself., GGUFGGUF, abbr.: A file format that packs an AI language model, often in a shrunken low-precision version, into one file that ordinary computers can load and run quickly; used by llama.cpp and Ollama., MLXMLX, prop. n.: A free Apple software toolkit for running and training AI models efficiently on Mac computers with Apple's own chips, popular for running language models locally on a laptop., model hubmodel hub, n.: An online library where trained AI models are published so that others can find, download and reuse them instead of training their own from scratch., ONNXONNX, prop. n.: A shared file format for trained AI models, so that a model built with one toolkit can be moved to and run by another, much as a PDF opens on any computer., TransformersTransformers, prop. n.: A free software library from Hugging Face that lets programmers download and use thousands of ready-trained AI models for text, images and sound with a few lines of code.