Model Weight & Checkpoint Storage

Model weight and checkpoint storage. Safetensors separates tensor data from layout metadata: a JSON header describes each tensor's name, shape, dtype and byte offset, followed by the raw tensor bytes, enabling mmap zero-copy loading; in contrast, PyTorch's default `torch.save` uses pickle serialization, and unpickling executes arbitrary code carried by `__reduce__`, an RCE risk. Checkpoint layouts: single files are simple but coarse-grained; large models use sharded checkpoints (one shard per rank/layer group plus an index.json) for parallel save/load. A model registry (Hugging Face Hub style) pairs a Model Card (purpose, limitations, data and training info) with immutable versions, rollback and canary support. Size and load-time estimates: FP16 weights cost $S = 2 \times N_{\text{params}}$ bytes and load in $T = S / B$ ($B$ = IO bandwidth), e.g. a 70B model $S \approx 140\,\text{GB}$ takes roughly 12 seconds at 12GB/s PCIe.

weights of gigabytes to hundreds of gigabytes need fast, safe loading and distribution; production needs multi-version coexistence, rollback and audit; interviews ask why Safetensors is faster and safer than pickle, how large checkpoints are organized, and how a registry enables versioning.

versus pickle, Safetensors avoids rebuilding an entire object graph (slow), has no code-execution surface (safe), and loads only requested tensors via mmap zero-copy (lazy) — hundreds of GB in seconds, with better cross-version stability. Versus manually copying weight files, an immutable-version registry with atomic switches makes rollback auditable and canary-friendly, preventing unrecoverable overwrite incidents.

Safetensors vs pickle? Why is unpickling model weights unsafe?

Why does Safetensors load faster? The mechanics of mmap zero-copy and lazy loading?

Single-file vs sharded checkpoints? How does an index enable parallel load on resume?

Core capabilities of a model registry (HF Hub style)? What should a Model Card contain?

How to design production model rollback? Immutable versions, atomic publish and canary?