Hugging Face 將 Safetensors 移至 PyTorch 基金會

🔑 增強重點摘要

• •The transition aims to mitigate supply chain risks by decoupling the format's maintenance from Hugging Face's internal infrastructure, ensuring long-term stability for critical AI infrastructure.
• •The PyTorch Foundation will establish a technical steering committee to oversee the evolution of the Safetensors specification, specifically targeting cross-framework compatibility beyond just PyTorch.
• •The move addresses long-standing security concerns regarding arbitrary code execution vulnerabilities inherent in the legacy pickle-based serialization used in traditional PyTorch model files.

🛠️ 技術深入

• •Safetensors utilizes a flatbuffer-like header structure that stores metadata (tensor shapes, dtypes, offsets) in a JSON-encoded string at the beginning of the file.
• •The format implements zero-copy loading by mapping the file directly into memory (mmap), allowing the framework to access tensor data without deserialization overhead.
• •It enforces strict separation between the metadata header and the raw binary tensor data, preventing the injection of malicious Python objects.
• •The specification supports memory-mapped tensor slicing, enabling efficient loading of specific model layers or shards without reading the entire file into RAM.

🔮 前景展望AI analysis grounded in cited sources

⏳ 時間線