Standard Format Elevated

Safetensors is being brought in as a project under the PyTorch Foundation. Its trademark, repository, and governance now fall under the Linux Foundation, while Hugging Face's core maintainers Luc and Daniel continue to handle technical operations.

Safetensors was originally created as a format to avoid the arbitrary code execution risk of pickle when storing and sharing model weights. It adopted a simple structure that describes metadata with a JSON header (up to 100MB) followed by raw tensor data, and provides zero-copy loading and lazy loading.

It has now become the default deployment format across the ecosystem, including the Hugging Face Hub, and is used by tens of thousands of models. This move to join the Foundation institutionally confirms that the project is an asset of the entire community that depends on it, not any single company.

For users, nothing changes. The format, API, and Hub integration remain the same, and there are no breaking changes.

Going forward, the key focus areas are:

• Collaborating so it's used as the torch model serialization system inside PyTorch core
• Device-aware loading/saving that loads directly to accelerators such as CUDA / ROCm
• APIs for Tensor Parallel / Pipeline Parallel setups so each rank/stage reads only the weights it needs
• Cleaning up support for block quantization like FP8, GPTQ, AWQ, and sub-byte integer types

In short, Safetensors has opened the possibility of growing beyond an already widely used, safe model format into a standard serialization layer integrated with PyTorch.