The Illusion of Safe Tensors: Why Valid Model Files Still Need Numerical Checks
SafeTensors guarantees that deserializing a model file cannot execute pickle code. It does not guarantee that the numbers inside are safe for the C++ and CUDA kernels that consume them.