AI glossary · Basic · AI platforms & solutions · AI security
safetensors
safetensors is a file format designed to store and load AI model weights (the numbers set through training) safely and quickly. Its main feature is that simply opening a file carries no risk of running hidden code.
About this term
- Level
- Basic · Technical terms you often meet in AI news
- Category
- Infrastructure & using models
- Added
- 2026-10-12
How it works
At the very start of the file is a small table of contents (the header), listing each tensor's (bundle of numbers) name, data type, shape and location in the file. After that, the actual numbers are simply laid out one after another, with no executable code. So a program can read just the table of contents and map the needed parts directly into memory (memory mapping) for fast loading. PyTorch's .bin and .pt files, which were commonly used before, rely on Python's pickle format, so arbitrary code could run the moment a file was opened; safetensors closes this hole by design.
pickle files vs safetensors
.bin·.pt (pickle)Older PyTorch approach
- Arbitrary code can run on open
- Must read in the whole file
safetensorsTable of contents + numbers only
- No code, so opening is safe
- Fast loading via memory mapping
- Contents can be checked from the header alone
공통 Both are files that store model weights
Where you'll see it
You will see it most often in the 'Files and versions' tab of a Hugging Face model page. Large models are split into several shards, such as model-00001-of-00004.safetensors, accompanied by model.safetensors.index.json, which records which tensor is in which shard. Adding up the shard file sizes gives a rough estimate of the memory needed to load the weights onto a GPU. Tools such as Transformers and vLLM read these files by default.
Things to know
safetensors is only a 'storage format,' not a guarantee that the model itself is safe. Opening the file may be safe, but the model could have picked up a backdoor during training, or Python code uploaded to the repository alongside it (trust_remote_code) could be dangerous. Also, if both safetensors and .bin versions of the same model are available, downloading the safetensors one is safer and faster. Note too that when running models on a laptop with llama.cpp-based tools, a different format called GGUF is usually used.
Example
When downloading an open-weight model from Hugging Face and the file list shows both .bin and .safetensors, it is common to configure downloads to fetch only safetensors, following internal security guidelines. Another common scene is looking at the total size of the shard files, thinking "this should fit on a single GPU," and choosing a serving setup accordingly.