AI Governance Engineer
GitHub

Safetensors

By Updated

A file format for storing a model's tensors safely, as opposed to Python pickle 1, whose loading can run arbitrary code and which the Python documentation calls not secure 2. Storing weights as safetensors, and scanning any remaining pickle files for code-executing imports before they reach a registry, closes a common supply-chain route into serving.

Developed in
ch. 14, Reproducibility and linked versioning
ch. 05, Pattern: Model Artefact Integrity
Chapters
ch. 05, Patterns · ch. 14, Development
Source
2 numbered references, listed below

Where it is used

The term is not used under this name in running prose; the sections listed under "Developed in" treat it.

Patterns that use this term

One pattern page uses the term.

Safetensors: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedColour: stack layer of the pattern02 InventorySafetensorsRelated terms (2)Build provenance (SLSA) · RelatedBuild provenance (SLSA)Model signing · RelatedModel signingPatterns using it (1)Model Artefact Integrity, 3 mentions · Uses the termModel Artefact Integrity
Safetensors: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedColour: stack layer of the pattern02 InventoryRelated terms (2)Build provenance (SLSA) · RelatedBuild provenance (SLSA)Model signing · RelatedModel signingPatterns using it (1)Model Artefact Integrity, 3 mentions · Uses the termModel Artefact IntegritySafetensors
The term's neighbourhood Terms related to this one on solid edges, terms it is often confused with on dashed edges, and the patterns that use it most in the colour of their layer. Follow a dashed edge to check the distinction before you use either term.
Neighbourhood as a table
Neighbourhood of Safetensors
FamilyItemRelation
Related termsBuild provenance (SLSA)Related
Related termsModel signingRelated
Patterns using itModel Artefact Integrity, 3 mentionsUses the term
  • Build provenance (SLSA)

    A verifiable record, in the SLSA format, of what built an artefact, by what process and from which top-level inputs.

  • Model signing

    Signing a model's files at build: a manifest lists every file with its cryptographic digest and a detached signature covers the manifest, so any changed file…

Sources

  1. [1] Safetensors ("a new simple format for storing tensors safely (as opposed to pickle)"). Hugging Face documentation. n.d. (accessed 2026-09-25). https://huggingface.co/docs/safetensors/index (verified: primary)
  2. [2] pickle: Python object serialization ("The pickle module is not secure. Only unpickle data you trust."). Python Software Foundation. 2026. https://docs.python.org/3/library/pickle.html (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Safetensors. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/safetensors. CC BY 4.0

BibTeX

@misc{aige2026safetensors,
  author  = {Jorge García Aibar},
  title   = {{Safetensors}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/safetensors}
}