On April 8, 2026, the PyTorch Foundation announced that Hugging Face’s safetensors — the secure model serialization format used by tens of thousands of AI models — has joined the foundation as an officially hosted project under the Linux Foundation. The move gives safetensors a vendor-neutral home alongside PyTorch, vLLM, DeepSpeed, and Ray.
General Audience
Key points
- On April 8, 2026, the PyTorch Foundation announced that Hugging Face’s safetensors has joined the foundation as an officially hosted project under the Linux Foundation.
- The move gives safetensors a vendor-neutral home alongside PyTorch, vLLM, DeepSpeed, and Ray, with the trademark, repository, and governance sitting with the Linux Foundation.
- Safetensors was created because the standard way of saving model weights in Python can execute arbitrary code when a file is loaded.
- The format uses a JSON header capped at 100MB followed by raw tensor data, and it supports zero-copy and lazy loading with no code execution.
- Hugging Face said the existing format, APIs, and Hub integration remain identical, and the roadmap includes device-aware loading, parallel loading, quantization support, and PyTorch core integration.
Why Safetensors Exists
Safetensors was created to solve a critical security problem: the standard way of saving model weights in Python can execute arbitrary code when a file is loaded. As model sharing exploded through platforms like the Hugging Face Hub, this became a serious vulnerability — anyone downloading and loading a model was potentially running untrusted code.
Safetensors replaces the legacy format with a deliberately simple design: a JSON header (capped at 100MB) followed by raw tensor data. It supports zero-copy loading through direct disk-to-memory mapping and lazy loading of individual weights without full deserialization. No code execution, ever.
What the Move Means
By joining the PyTorch Foundation, safetensors gains:
- Vendor neutrality — the trademark, repository, and governance now sit with the Linux Foundation rather than any single company
- Formalized governance — new GOVERNANCE.md and MAINTAINERS.md documents open a clear path for community maintainers
- Long-term stability — community-driven governance ensures the format won’t be abandoned or changed unilaterally
Hugging Face emphasized that nothing breaks: existing format, APIs, and Hub integration remain identical.
What’s Coming Next
The safetensors roadmap includes several features designed for modern multi-GPU AI infrastructure:
- Device-aware loading: Load tensors directly to CUDA or ROCm without staging through CPU
- Parallel loading: First-class APIs for Tensor Parallel and Pipeline Parallel deployments where each rank loads only needed weights
- Quantization support: FP8, block-quantized formats (GPTQ, AWQ), and sub-byte integer types
- PyTorch core integration: Working with the PyTorch team to use safetensors as the serialization system in torch itself
This post was drafted with AI assistance and reviewed by RITS staff.
Leave a Reply