UNDERSTANDING SAFETENSORS: A SECURE ALTERNATIVE TO PICKLE FOR ML MODELS

Summary from the TLDR InfoSec newsletter

Python Pickles are a binary format that is commonly used to distribute ML models but is inherently insecure because arbitrary code can be executed during deserialization. SafeTensors is a format that was created to solve this issue by only storing metadata and numerical tensors. SafeTensors binaries should always be preferred over Pickles when available as in addition to the security benefits, they can also be more performant.