safetensors
A secure model serialization format introduced by Hugging Face as a replacement for the pickle format, which carries code execution risks. It fundamentally mitigates deserialization attacks and serves as a security standard for AI model file storage.
Core Facts
The Qwen2.5:7B model is approximately 4 GB in size after Q4 quantization.
.safetensors is a safe and efficient model weight storage format introduced by Hugging Face.
Python pickle格式在反序列化时可以执行任意代码，攻击者可以在模型文件中嵌入恶意代码
Timeline (last 90 days)
During safetensors import, the MLX framework assembles the ModelOpt expert banks for Flint.
This version assembles ModelOpt expert banks during the safetensors import stage, rather than processing them after model instantiation.
Using convert_huggingface_to_gguf.py to convert Gemma 2 2B from safetensors to f16 GGUF took less than a minute in testing, and the output file is about 5.2GB.
The safetensors index file (usually named model.safetensors.index.json) is a manifest used in the Hugging Face ecosystem for sharded weights, listing the name of each tensor and the shard file it is in, reflecting the weights that actually exist, and is the most reliable basis for determining what a model actually ships with.
AREX-2's config.json declares mtp_num_hidden_layers as 1, but its safetensors weight index contains no tensors prefixed with mtp (0), whereas the index of the base model Qwen3.8 contains 15 mtp tensors.
Enterprises should prioritize secure formats such as safetensors, perform hash verification on model files, and download weights only from trusted sources.
vLLM can also read GGUF on GPUs through its plugin, but not all quantization types are supported, in some cases the --quantization parameter must be specified manually, and performance may differ from the native safetensors path; the official recommendation remains safetensors as vLLM's preferred format.
Safetensors is a serialization container consisting of a JSON header plus raw byte tensors; it does not perform quantization and is only responsible for storage, typically carrying BF16 or FP16 precision.
safetensors can be opened in transformers, native vLLM environments, ComfyUI, and Apple's MLX toolchain.
Conversion between formats is possible, but it is almost never worth it, because every conversion is a new opportunity for weights to silently diverge.
19 more timeline events
All Facts (20)
The Qwen2.5:7B model is approximately 4 GB in size after Q4 quantization.
80%Verified.safetensors is a safe and efficient model weight storage format introduced by Hugging Face.
65%VerifiedPython pickle格式在反序列化时可以执行任意代码，攻击者可以在模型文件中嵌入恶意代码
65%VerifiedSafeTensors uses a simple header-plus-data structure that contains no executable code, eliminating the security risk of arbitrary code execution during deserialization present in the traditional pickle format.
65%Unverified配合Hugging Face Hub，Transformers建立了模型分发的事实标准，包括模型卡片（Model Card）、权重格式（safetensors）、配置文件等规范
85%UnverifiedCAPABILITY declarations are preserved when creating a model from GGUF or safetensors, when inheriting via a model, and when exporting a Modelfile.
70%UnverifiedDuring safetensors import, the MLX framework assembles the ModelOpt expert banks for Flint.
50%UnverifiedThis version assembles ModelOpt expert banks during the safetensors import stage, rather than processing them after model instantiation.
50%UnverifiedThe safetensors index file (usually named model.safetensors.index.json) is a manifest used in the Hugging Face ecosystem for sharded weights, listing the name of each tensor and the shard file it is in, reflecting the weights that actually exist, and is the most reliable basis for determining what a model actually ships with.
50%UnverifiedAREX-2's config.json declares mtp_num_hidden_layers as 1, but its safetensors weight index contains no tensors prefixed with mtp (0), whereas the index of the base model Qwen3.8 contains 15 mtp tensors.
50%UnverifiedEnterprises should prioritize secure formats such as safetensors, perform hash verification on model files, and download weights only from trusted sources.
50%UnverifiedFormat choice is determined by the runtime already in use: Ollama/LM Studio/llama-server automatically select GGUF, Python/transformers pipelines automatically select safetensors, vLLM on GPU servers natively supports safetensors, and ComfyUI or image pipelines use safetensors.
50%UnverifiedSafetensors is a serialization container consisting of a JSON header plus raw byte tensors; it does not perform quantization and is only responsible for storage, typically carrying BF16 or FP16 precision.
50%Unverifiedsafetensors can be opened in transformers, native vLLM environments, ComfyUI, and Apple's MLX toolchain.
50%UnverifiedvLLM can also read GGUF on GPUs through its plugin, but not all quantization types are supported, in some cases the --quantization parameter must be specified manually, and performance may differ from the native safetensors path; the official recommendation remains safetensors as vLLM's preferred format.
50%UnverifiedOllama is built on the GGUF engine, but it still provides an MLX runner so that Apple Silicon users can load weights originating from safetensors.
50%UnverifiedGGUF BF16 is about 20% smaller than safetensors BF16, because llama.cpp serializes and packs tensors more compactly, while safetensors preserves the training framework's original tensor layout and JSON header.
50%UnverifiedGGUF makes quantization the default option, while safetensors makes full precision the default option; this default value is most of the format-selection decision.
50%UnverifiedConversion between formats is possible, but it is almost never worth it, because every conversion is a new opportunity for weights to silently diverge.
50%UnverifiedNeural network weights are essentially multi-dimensional arrays (tensors) stored in file formats such as .safetensors, .gguf, or .bin, and the numbers themselves are static and cannot execute on their own.
50%