Hugging Face hands Safetensors to Linux Foundation to keep model format truly open

Hugging Face is transferring its Safetensors model format to the PyTorch Foundation, placing it under neutral Linux Foundation governance. The move transforms a single company’s solution to a dangerous problem into community-owned infrastructure. Safetensors was built to solve a specific nightmare: the dominant pickle-based formats could execute arbitrary code, a risk that became untenable as open model sharing exploded. The format is deliberately boring—a JSON header capped at 100MB describing tensor metadata, followed by raw data. That simplicity is the point. It enables zero-copy loading that maps tensors straight from disk and lazy loading so you can grab individual weights without deserializing an entire checkpoint.

What started as a Hugging Face internal project is now the default delivery mechanism for tens of thousands of models across every modality. The two core maintainers, Luc and Daniel, stay on the Technical Steering Committee and continue leading day-to-day work. But the trademark, repo, and governance now sit with the Linux Foundation rather than any single company. For everyday users, nothing breaks. The format, APIs, and Hub integration remain identical. What changes is the path to becoming a maintainer—it’s now formally documented and open to anyone willing to do the work.

The roadmap is ambitious. The team is working with PyTorch to potentially make Safetensors a core serialization system for torch models. Device-aware loading is coming, letting tensors land directly on CUDA, ROCm, and other accelerators without a wasteful CPU pit stop. First-class APIs for Tensor Parallel and Pipeline Parallel loading mean each rank or pipeline stage will only pull the weights it actually needs. The team is also formalizing support for FP8, block-quantized formats like GPTQ and AWQ, and sub-byte integer types. These are ecosystem-wide problems that make more sense to solve collaboratively under a foundation roof than in parallel silos. Hugging Face bet that safety infrastructure works best when no single company controls it. The governance now reflects that bet.