Crabhaus

What it is

A model file is a bundle of named tensors (the learned weights) plus metadata describing their shapes and types. The format is the container, not the model: classic PyTorch checkpoints (.pt/.ckpt) are pickled Python objects, safetensors is a restricted weights-only format, and GGUF is a single-file binary built for local inference engines in the llama.cpp family.

How it works

Pickle checkpoints can execute code on load, which is why torch.load warns and offers weights_only. Safetensors fixes this by design: a JSON header lists each tensor's name, dtype, shape, and offset, then one flat buffer of raw bytes - loaders mmap it and never execute anything. GGUF adds model metadata and a tokenizer beside usually pre-quantized tensors, so llama.cpp mmaps one file and runs.

A concrete example

A Llama-style release on Hugging Face ships as sharded .safetensors files plus config.json and tokenizer files; transformers loads that directly. To run the same model in llama.cpp or Ollama, you convert it into a single .gguf at a chosen quantization: a 7B model that needs roughly 14 GB as fp16 safetensors becomes about a 4 GB Q4_K_M GGUF that fits consumer hardware.

Why it matters

The format decides which tooling can load a model, whether a stranger's file is safe to open, and whether quantized local inference is possible. Hugging Face made safetensors its default after a security audit because pickle checkpoints from untrusted sources are an execution risk - and GGUF is why one downloaded file runs offline on a laptop.