Safetensors A model file that holds numbers and nothing else.
Short answer. Safetensors is a file format, developed by Hugging Face, that stores a model’s weights as plain tensors behind a small header, designed so that loading a file you downloaded cannot run hidden code. It replaces the PyTorch pickle format, which can execute arbitrary code when loaded: a malicious file posing as a model could give an attacker control of the computer. A safetensors file holds an 8-byte length, a JSON header listing each tensor’s name, type, shape and position, and then the raw numbers. An external audit by Trail of Bits, published in May 2023, found no critical flaw leading to arbitrary code execution.
01
How the format works
The specification is short. The first 8 bytes are an unsigned 64-bit number giving the size of the header. The header is a JSON text that lists every tensor with its data type, its shape and where its bytes begin and end. The rest of the file is the byte buffer holding the numbers. The byte buffer must be fully indexed with no gaps, a rule that prevents files that are valid as two different formats at once.
Because the header says where each tensor lies, a program can read a single tensor without scanning the file, which helps when a model is split across several GPUs, and it can read the numbers without making a second copy in memory. There is no file size limit, and bfloat16 and 8-bit floating-point types are supported.
02
File types and the code they can run
File type
Can loading it run code?
Note
.safetensors
No, by design
Holds tensors only. The model’s configuration and tokenizer sit in separate files in the same folder
.gguf
Not by design: it holds data and metadata
A single file with tensors, tokenizer and chat template, used by llama.cpp and Ollama
.bin, .pt, .pkl (PyTorch pickle)
Yes
Pickle can execute code. Avoid files from sources you do not know
A repository that asks for trust_remote_code
Yes: it runs Python from the repository
Hugging Face’s documentation says to pass the flag only for code you have written or reviewed
03
What a safe format does not guarantee
It says nothing about what the model has learned. A safe container can hold a biased or unsuitable model, so read the model card and test it on your own work.
It does not prove who made the file. Download from the maker’s own organisation page and compare the checksum the publisher gives.
It does not make the loading software bug-free. Keep the runtime updated.
It does not cover extra code in the same repository. Check for custom Python files before enabling remote code.
04
Why it matters for an office
A model file from the internet is software you bring into the building, and the pickle format means that opening it can be as risky as running an unknown program. For an IT head, the rule is simple: prefer safetensors or GGUF from the maker’s own page, never enable remote code for a repository nobody has reviewed, keep the checksum with the file, and test new models on a machine with no access to client data first.
The audit behind the format matters too. Trail of Bits examined safetensors with Hugging Face, EleutherAI and Stability AI, found no critical flaw that could lead to arbitrary code execution, and reported specification gaps and file-format tricks that were then fixed.
On updates, ANVE’s security page says the box does not update itself over the internet. Today ANVEAI installs updates on site, and signed update packages applied offline by USB are not on ANVE yet.
05
Questions people ask
Is safetensors the same as GGUF?
No. Both avoid the code-execution risk of pickle, but safetensors stores only tensors and is used by libraries such as Transformers and vLLM. GGUF packs tensors, tokenizer and chat template into one file for llama.cpp and Ollama.
Is safetensors faster than other formats?
It is designed for fast loading: tensors can be read directly without a second copy, and single tensors can be read without scanning the whole file. Actual speed depends on your disk and software.
Does a safetensors file mean the model is safe to use?
No. It means the file format cannot carry code. Whether the model behaves well is a separate question, answered by testing.
Who built safetensors?
Hugging Face. The 2023 external audit was run by Trail of Bits in collaboration with Hugging Face, EleutherAI and Stability AI.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
