Model & ML supply-chain security
safetensors is a safe tensor file format for model weights from PyTorch Foundation (Linux Foundation). It is open source under the Apache-2.0 license and is offered as: Library.
Best for
ML teams that publish or load model weights and want a format that avoids pickle deserialization
Ownership
Hugging Face announced on April 8, 2026 that Safetensors joined the PyTorch Foundation (Linux Foundation); Hugging Face's maintainers continue to lead the project day-to-day. Source, checked October 21, 2026: huggingface.co (opens in a new tab)
Consider instead if
safetensors is an open-source file format and library for storing and sharing model weights as an alternative to pickle. The README compares it with pickle, which its table marks as not safe because a downloaded file can run arbitrary code, and describes limits on header size and non-overlapping data regions that resist denial-of-service attacks. A third-party audit by Trail of Bits, announced by Hugging Face on May 23, 2023, reported no critical flaw leading to arbitrary code execution. Since April 2026 the project is hosted by the PyTorch Foundation under the Linux Foundation. The Python package installs with pip and the license is Apache-2.0. It is a storage format, not a scanner: it does not inspect files saved in other formats.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L3 Supply chain Model and supply chain | Primary | Check that models, datasets and AI components from outside are what they claim to be and do not run code or hide backdoors when loaded. | Follows its category, Model & ML supply-chain security |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM03 Supply Chain | Offers a weights format that avoids pickle, which the README table marks as not safe because a downloaded file can run arbitrary code. | Stores tensors in a format the README marks safe, and marks pickle as not safe because a downloaded pickle file can run arbitrary code; Format limits the header to 100MB and guarantees non-overlapping data regions to resist denial-of-service attacks; A Trail of Bits audit commissioned by Hugging Face with EleutherAI and Stability AI found no critical flaw leading to arbitrary code execution |
More in Model & ML supply-chain security, ranked within the category by Coverage Score.
OpenAI (Promptfoo)
Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.
Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Reviewed
Palo Alto Networks (Protect AI)
Scans saved ML model files for unsafe serialized code before you load them, from a CLI or Python.
Best for: ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Reviewed
Signs machine learning model files and verifies them later so tampering can be detected.
Best for: Teams that publish or consume models and want a free way to sign model files and check signatures before loading them
Reviewed
Yes. safetensors is released under the Apache-2.0 license, and the code is on GitHub at safetensors/safetensors.
Hugging Face announced a Trail of Bits audit on May 23, 2023. It reported no critical security flaw leading to arbitrary code execution.
No. It is a storage format and library. Scanning pickle-based files needs a separate tool.
Hugging Face's post of April 8, 2026 says Safetensors joined the PyTorch Foundation as a foundation-hosted project under the Linux Foundation, and that Hugging Face's core maintainers continue to lead the project day-to-day.
safetensors is released under the Apache-2.0 license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
safetensors is offered as: Library.
Source Source, checked October 21, 2026: huggingface.co (opens in a new tab) Checked
Pricing model for safetensors: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Latest release of safetensors: June 9, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with PyTorch Foundation (Linux Foundation).