Safetensors Joins the PyTorch Foundation as a Vendor-Neutral Standard

On April 8, 2026, the PyTorch Foundation announced that Hugging Face’s safetensors — the secure model serialization format used by tens of thousands of AI models — has joined the foundation as an officially hosted project under the Linux Foundation. The move gives safetensors a vendor-neutral home alongside PyTorch, vLLM, DeepSpeed, and Ray.

General Audience

Why Safetensors Exists

Safetensors was created to solve a critical security problem: the standard way of saving model weights in Python can execute arbitrary code when a file is loaded. As model sharing exploded through platforms like the Hugging Face Hub, this became a serious vulnerability — anyone downloading and loading a model was potentially running untrusted code.

Safetensors replaces the legacy format with a deliberately simple design: a JSON header (capped at 100MB) followed by raw tensor data. It supports zero-copy loading through direct disk-to-memory mapping and lazy loading of individual weights without full deserialization. No code execution, ever.

What the Move Means

By joining the PyTorch Foundation, safetensors gains:

• Vendor neutrality — the trademark, repository, and governance now sit with the Linux Foundation rather than any single company
• Formalized governance — new GOVERNANCE.md and MAINTAINERS.md documents open a clear path for community maintainers
• Long-term stability — community-driven governance ensures the format won’t be abandoned or changed unilaterally

Hugging Face emphasized that nothing breaks: existing format, APIs, and Hub integration remain identical.

What’s Coming Next

The safetensors roadmap includes several features designed for modern multi-GPU AI infrastructure:

• Device-aware loading: Load tensors directly to CUDA or ROCm without staging through CPU
• Parallel loading: First-class APIs for Tensor Parallel and Pipeline Parallel deployments where each rank loads only needed weights
• Quantization support: FP8, block-quantized formats (GPTQ, AWQ), and sub-byte integer types
• PyTorch core integration: Working with the PyTorch team to use safetensors as the serialization system in torch itself

Sources

• Safetensors is Joining the PyTorch Foundation — Hugging Face Blog
• PyTorch Foundation Announcement
• Hugging Face Contributes Safetensors To PyTorch Foundation — Phoronix
• safetensors on GitHub