Safetensors is Joining the PyTorch Foundation

Today, we're announcing that Safetensors has joined the PyTorch Foundation as a foundation-hosted project under the Linux Foundation, alongside DeepSpeed, Helion, Ray, vLLM, and PyTorch itself.

How we got here

Safetensors started as a Hugging Face project born out of a concrete need: a way to store and share model weights that couldn't execute arbitrary code. The pickle-based formats that dominated the ecosystem at the time meant that there was a very real risk you’d be running malicious code. While this was an acceptable risk when ML was still budding, it would become unacceptable as open model sharing became central to how the ML community works.

The format we built is intentionally simple: a JSON header with a hard limit of 100MB, describing tensor metadata, followed by raw tensor data. Zero-copy loading that maps tensors directly from disk. Lazy loading so you can read individual weights without deserializing an entire checkpoint.

What we didn't fully anticipate was how broadly it would be adopted. Today, Safetensors is the default format for model distribution across the Hugging Face Hub and others, used by tens of thousands of models across all modalities in ML. It has become the preferred way for the open source ML community to share models.

Why the PyTorch Foundation

We believe safety is best guaranteed when every contributor can build on what already exists; a principle now embedded in the project's governance itself.

What this means for users and contributors

For the vast majority of users, nothing changes. The format is the same, the APIs are the same, the Hub integration is the same: no breaking changes. Models stored in Safetensors format today will continue to work exactly as they do now.

What comes next

Safetensors is a well-established project, adopted by the ecosystem at large, but we're still convinced we're at the very beginning of the project.