The security audit results are in, and safetensors just cleared the bar that matters most: no critical flaws allowing arbitrary code execution. Trail of Bits ran the assessment, and Hugging Face, EleutherAI, and Stability AI published the full report publicly — a move that says more about their confidence than any press release could.
For anyone who’s been watching the ML ecosystem fumble with pickle files for years, this is a long-overdue shift. PyTorch’s reliance on pickle means a malicious model file can hand an attacker full control of a machine. The security community has known this forever, and the PyTorch docs acknowledge it. But plenty of ML practitioners still don’t. Safetensors was built specifically to close that gap — written in Rust, framework-agnostic across PyTorch, TensorFlow, JAX, PaddlePaddle, and NumPy, and roughly 100x faster on CPU loads thanks to lazy loading.
The audit wasn’t completely clean, which is actually reassuring. Trail of Bits found imprecisions in the format spec, some validation gaps that allowed polyglot files, and plenty of room to improve the test suite. All of those issues have been fixed. No audit can prove a codebase is flawless, but a rigorous one that finds fixable problems and confirms no critical exploit exists is about as good as it gets.
What happens next is already in motion. Safetensors is now a core dependency in transformers, and the plan is to make it the default saving format within a few months. EleutherAI has added safetensors support to its LM Evaluation Harness and is working on GPT-NeoX integration. The lazy loading capability is already proving its worth for LLM inference — it’s what lets text-generation-inference load models like LLaMA and StarCoder efficiently across different hardware configurations. The pickle era isn’t over yet, but it’s now on a countdown clock.
