Safetensors is a file format for storing machine learning tensors in a way that avoids executing embedded code when a model is loaded. It reduces the risk of malicious deserialisation compared with more flexible formats, but defenders still need provenance checks, integrity validation and trusted sources before importing models.
What Safetensors Is and Why It Exists
Safetensors is a model file format designed to store machine learning tensors without executing embedded code on load. That design choice matters because many model-loading workflows treat files as trusted inputs, so a safer storage format reduces the attack surface created by deserialisation.
The core idea is simple: tensors are data, not instructions. By separating model weights from executable serialisation logic, safetensors removes one of the most dangerous behaviours associated with flexible model formats and makes the file itself easier to reason about during review and ingestion.
How Safetensors Changes the Trust Model
With traditional model artefacts, the loader may need to interpret complex object graphs or run deserialisation code. Safetensors narrows that behaviour to structured data access, which means the security question shifts from “what code runs when I open this file?” to “can I trust the source and integrity of this file?”
That is why provenance still matters. A non-executable format reduces the chance of code execution during load, but it does not tell you whether the model weights themselves were altered, poisoned, or replaced. In practice, safetensors is a control for safer ingestion, not a substitute for source trust.
For teams building an AI supply chain, this fits naturally with broader artefact governance. An AI Supply Chain Security and AI-BOM Guide helps place model files, provenance checks, and integrity controls into a wider import and release process.
Where Safetensors Helps Most in Practice
Safetensors is most valuable when model artefacts arrive from third parties, shared hubs, experiments, or automated pipelines where loaders may otherwise accept untrusted inputs. It reduces the risk that a model file can trigger arbitrary behaviour simply because it is opened by a framework.
That said, its benefit is bounded. If the surrounding pipeline permits unsigned downloads, uncontrolled promotion of artefacts, or weak source validation, an attacker can still introduce malicious or tampered models. The format improves safety at load time, but it does not solve supply-chain trust by itself.
For defenders, the key operational lesson is to treat the format as one layer in a broader model-intake process that includes allowed sources, checksum validation, and review of artefact origin before deployment.
Safer Use Means More Than Choosing the Format
Safetensors is best understood as a hardening measure that lowers deserialisation risk, especially when compared with permissive formats that may execute embedded logic. It is a strong default for environments that want to minimise model-loading attack surface.
Defensive value increases when the organisation pairs the format with integrity checks, provenance controls, and restricted import paths. That combination helps ensure the file is not only safe to parse, but also trustworthy enough to use.
SLSA is relevant here because model artefacts, like software artefacts, benefit from provenance and integrity discipline across the supply chain.
NIST AI Risk Management Framework also fits the control mindset, since safe model ingestion is part of trustworthy AI governance rather than a purely file-format decision.
Risk and Threat Considerations
Safetensors reduces one specific hazard, malicious deserialisation, but it does not eliminate the broader risk of importing compromised models. A file can still carry poisoned weights, misleading behaviour, or an untrusted supply chain origin even when it cannot execute code on load.
Failure mechanism: Defenders assume a non-executable format is sufficient, then skip provenance checks, integrity validation, or source restrictions, allowing a tampered model to enter the environment through a trusted ingestion path.
Impact: The organisation may deploy a model that behaves maliciously, contains manipulated parameters, or becomes a foothold for downstream compromise through the AI pipeline.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SLSA, NIST AI RMF and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SLSA | Supply Chain Levels for Software Artifacts | Model artefact provenance and integrity are central to safe tensor imports. |
| Recommendation — Track model provenance and verify artefact integrity before promotion. | ||
| NIST AI RMF | AI Risk Management Framework | Safetensors supports trustworthy AI ingestion and risk governance for model artefacts. |
| Recommendation — Apply AI risk governance to model intake, validation, and deployment decisions. | ||
| CIS Controls v8 | CIS-15 — Service Provider Management | Third-party model sources create supply-chain trust risk that needs governance. |
| Recommendation — Vet external model sources and restrict approval to trusted providers. | ||
Practitioner Guidance
Why practitioners should care: Use safetensors as the safer default for model storage, but do not confuse format safety with model trust. The format should be part of a controlled intake process, not the final assurance signal.
What to watch for: Any workflow that accepts third-party model files, converts between formats, or auto-promotes artefacts without source verification deserves extra scrutiny, because the highest risk often appears before the model is ever run.
Practitioner takeaway: Prefer safetensors for reduced load-time risk, then back it with provenance, integrity, and source-control checks before a model is allowed into production.