Add support for safetensors
- Dominant language
- Python
- Stars
- 4.8k
- Forks
- 487
- PR merge metrics
- No merged PRs in 30d
Description
### 🚀 The feature, motivation, and pitch
By default, PyTorch uses the Pickle format to save and load models. Unloading a Pickle file could unfortunately lead to remote code execution, which is a grave vulnerability. So any Pickle model that you load must come from a trusted source. Safetensors addresses that. It uses a different file format, and defines alternative functions to torch.load and torch.save. Using safetensors shouldn't impact the inference, only the loading and saving. It also offers a few other advantages such as "zero-copy" or lazy loading, which they say can significantly improve the loading time especially on distributed settings.
Note : support for safetensors is planned in peft 0.4.0
### Alternatives
_No response_
### Additional context
screenshots from https://github.com/huggingface/safetensors :


Contributor guide
Assessment
This issue has not been assessed yet.