Free tools Windows power users keep installed
One-click scans. No signup required.
For tensor-only model weights from an unfamiliar source, safetensors is generally the safer choice. It stores tensor data rather than Python pickle instructions, avoiding pickle deserialization in the weight-file path. A pickle-based checkpoint can execute code when loaded without restrictions; PyTorch’s weights_only=True narrows that risk for supported cases but does not turn pickle into safetensors.
Why can a model weight file be a security risk?
Loading an unrestricted pickle can execute code with the privileges of the process that loads it. A checkpoint from an unknown source is therefore a software supply-chain input, not just passive data. If the loading process can access credentials, files, or systems, malicious pickle content may be able to act with that access. Hugging Face explains the risk and trust considerations in its pickle-scanning guidance.
As an Amazon Associate I earn from qualifying purchases.
How do safetensors and pickle differ?
| Question | Safetensors | Pickle-based PyTorch checkpoint |
|---|---|---|
| Can deserialization run pickle instructions? | The format stores tensor data and does not encode arbitrary pickle instructions. | Unrestricted pickle deserialization can execute code. |
| What can it represent? | A narrower set: tensor weights and supported associated metadata. | A broader range of Python object structures, which can help when a checkpoint contains more than tensor weights. |
| What does this mean for loading safety? | Its design removes pickle deserialization from the weight-file path. | PyTorch’s weights_only=True restricts loading in supported cases, but does not make every pickle checkpoint safe. |
| When is it a practical fit? | Distributing tensor-only weights, particularly across a trust boundary. | Workflows that need richer serialization, provided the source and loading method are appropriately trusted or isolated. |
PyTorch describes safetensors as a format for tensor data; its design and scope are documented in the PyTorch safetensors reference. The format’s narrower scope is a trade-off, not a claim that every application using it is secure. PyTorch’s security policy puts that trade-off plainly: “Safetensors gives the most safety but is the most restricted in what it supports.” See the PyTorch security policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Does PyTorch’s weights_only=True make pickle safe?
It reduces risk for supported state-dict loading by using a restricted unpickler rather than unrestricted pickle loading. Starting with PyTorch 2.6, the documented default for torch.load is weights_only=True when no pickle_module is passed. That default is version-sensitive: check the PyTorch version and the library code path actually used by your application. The restricted mode has limitations and does not make all pickle content safe. Consult PyTorch’s serialization documentation before relying on a particular loading workflow.
#1 Best Overall
Which format should you choose?
Choose safetensors for tensor-only weights from unfamiliar sources
Prefer a safetensors file when you need model tensors and do not need arbitrary Python objects serialized in the checkpoint. This avoids the pickle deserialization path for the weight file and is the safer default across trust boundaries.
Use pickle only when the workflow needs its broader support
Some legacy or specialized checkpoints contain objects beyond tensor weights. If that richer serialization is necessary, verify the publisher and repository, use restricted loading where compatible, and avoid unrestricted loading of untrusted files. If unrestricted loading is unavoidable, isolate it from valuable credentials and systems. Isolation is prudent operational practice; it is not a guarantee that a particular sandbox or environment eliminates risk.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do you convert a PyTorch checkpoint to safetensors?
Hugging Face documents a conversion workflow for PyTorch weights in its guide to converting weights to safetensors. Conversion does not make an untrusted source checkpoint safe by itself: if the workflow must load the original pickle, that loading step is still the risk. Prefer a safetensors version already published by a source you trust. For a legacy file, establish trust and choose a compatible restricted-loading workflow before conversion rather than casually loading it just to change formats.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
