🐶Safetensors audited as really safe and becoming the default

Hugging Face, in close collaboration with EleutherAI and Stability AI, has ordered an external security audit of the safetensors library, the results of which allow all three organizations to move toward making the library the default format for saved models.

The full results of the security audit, performed by Trail of Bits, can be found here: Report.

The following blog post explains the origins of the library, why these audit results are important, and the next steps.

What is safetensors?

🐶Safetensors is a library for saving and loading tensors in the most common frameworks (including PyTorch, TensorFlow, JAX, PaddlePaddle, and NumPy).

For a more concrete explanation, we'll use PyTorch.

import torch
from safetensors.torch import load_file, save_file

weights = {"embeddings": torch.zeros((10, 100))}
save_file(weights, "model.safetensors")
weights2 = load_file("model.safetensors")

It also has a number of cool features compared to other formats, most notably that loading files is safe, as we'll see later.

When you're using transformers, if safetensors is installed, then those files will already be used preferentially in order to prevent issues, which means that

pip install safetensors

is likely to be the only thing needed to run safetensors files safely.

Going forward and thanks to the validation of the library, safetensors will now be installed in transformers by default. The next step is saving models in safetensors by default.

We are thrilled to see that the safetensors library is already seeing use in the ML ecosystem, including:

• Civitai
• Stable Diffusion Web UI
• dfdx
• LLaMA.cpp

Why create something new?

The creation of this library was driven by the fact that PyTorch uses pickle under the hood, which is inherently unsafe. (Sources: 1, 2, video, 3)

With pickle, it is possible to write a malicious file posing as a model that gives full control of a user's computer to an attacker without the user's knowledge, allowing the attacker to steal all their bitcoins 😓.

Full report