safetensors
A tensor format and library stores AI model weights without pickle's code execution risk, with Python and Rust support and partial loading.
Safetensors is a file format and library for developers storing and loading AI model weights on their own hardware or servers. It addresses the arbitrary code execution risk of pickle-based PyTorch files.
- Safer weight files: Store tensor data without executing pickle code during loading; the reader also limits header size and rejects overlapping tensor data regions.
- Partial loading: Read individual tensors or slices, useful when dividing a model's weights across multiple GPUs.
- Memory use: CPU loading can reuse cached file data without copying tensor contents. GPU loading requires a copy, but can avoid holding all tensors in CPU memory at once.
- AI software support: Transformers, MLX, Diffusers, ComfyUI and text-generation-webui use the format for language model and image generation workflows.
The library is open source under Apache 2.0, with a Rust implementation and Python support. It handles tensor storage rather than model inference. Tensors must be packed before saving because the format doesn't preserve strided layouts, and metadata values must be strings.
Logotyper
