{
  "schemaVersion": "1.0",
  "canonicalPage": "https://fileformat.co/ext/pt",
  "inspectorUrl": "https://fileformat.co/inspect",
  "spec": {
    "slug": "pt",
    "extension": ".pt",
    "aliases": [
      ".pth"
    ],
    "name": "PyTorch Model & Tensor Checkpoint",
    "shortName": "PyTorch PT",
    "category": "ai-ml",
    "tier": 1,
    "summary": "Default PyTorch `torch.save()` archive wrapping a Python Pickle instruction stream (`data.pkl`) alongside raw tensor storage files inside a ZIP container.",
    "technicalNotes": "Since PyTorch 1.6+, `.pt` files use a PKZIP container (`archive/data.pkl`, `archive/version`, `archive/data/0`). Standard Pickle opcodes execute arbitrary Python callables unless `weights_only=True` is enforced.",
    "mimeTypes": [
      "application/x-pytorch",
      "application/zip"
    ],
    "identifiers": {
      "specUrl": "https://pytorch.org/docs/stable/notes/serialization.html"
    },
    "binarySignature": {
      "endianness": "little",
      "magicBytes": [
        {
          "offset": 0,
          "hex": "50 4B 03 04",
          "ascii": "PK..",
          "description": "PyTorch ZIP archive header (disambiguated via archive/data.pkl)"
        }
      ],
      "containerFamily": "zip",
      "headerLayout": [
        {
          "offset": "0x00 - 0x03",
          "byteOffset": 0,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint32_le",
          "fieldName": "zip_magic",
          "description": "PKZIP local header 0x04034B50"
        },
        {
          "offset": "0x1E+",
          "byteOffset": 30,
          "byteLength": 16,
          "lengthLabel": "var",
          "dataType": "ascii",
          "fieldName": "entry_path",
          "description": "Archive entry (e.g. archive/version or archive/data.pkl)"
        }
      ]
    },
    "securityProfile": {
      "riskLevel": "high",
      "allowsArbitraryCodeOrMacros": true,
      "xxeRisk": false,
      "polyglotPrependRisk": true,
      "pickleDeserializationRisk": true,
      "uploadValidationNotes": "CRITICAL: Never call legacy torch.load() without weights_only=True on untrusted .pt/.pth uploads—Pickle GLOBAL/REDUCE opcodes enable instant RCE. Prefer SafeTensors."
    },
    "codeSnippets": {
      "python": "import sys, zipfile\nwith zipfile.ZipFile(sys.argv[1], \"r\") as zf:\n    names = zf.namelist()\n    has_pkl = any(n.endswith(\"data.pkl\") for n in names)\n    print(f\"PyTorch ZIP entries={len(names)}, has_pickle={has_pkl}\")",
      "typescript": "export async function probeZipSig(file: File) {\n  const b = new Uint8Array(await file.slice(0, 4).arrayBuffer());\n  return b[0] === 0x50 && b[1] === 0x4b;\n}",
      "rust": "use std::{fs::File, io::Read};\nfn main() -> std::io::Result<()> {\n    let mut b = [0u8; 4];\n    File::open(std::env::args().nth(1).expect(\"usage: <prog> <file>\"))?.read_exact(&mut b)?;\n    println!(\"PT container sig: {:02X?}\", b);\n    Ok(())\n}",
      "go": "package main\nimport (\"archive/zip\"; \"fmt\"; \"os\")\nfunc main() {\n    r, err := zip.OpenReader(os.Args[1])\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"open zip:\", err)\n        os.Exit(1)\n    }\n    defer r.Close()\n    for _, f := range r.File { fmt.Println(f.Name) }\n}"
    },
    "relatedFormats": [
      "safetensors",
      "gguf",
      "onnx"
    ],
    "verifiedAt": "2026-11-14T16:09:03Z"
  },
  "samples": [
    {
      "id": "pt-minimal",
      "filename": "minimal-checkpoint.pt",
      "variant": "minimal",
      "title": "Minimal PyTorch ZIP Checkpoint",
      "description": "Real torch.save state dict (2 tensors) — loads cleanly via torch.load(weights_only=True).",
      "localPath": "/fixtures/v1/pt/minimal-checkpoint.pt",
      "cdnUrl": "https://fileformat.co/fixtures/v1/pt/minimal-checkpoint.pt",
      "sizeBytes": 1829,
      "sha256": "64f990b860de211afe49a1c8c9627cf4da92d75f69a29a2cb85c06927c62720c",
      "expectValid": true
    },
    {
      "id": "pt-realistic",
      "filename": "transformer-state-dict.pt",
      "variant": "realistic",
      "title": "Multi-Tensor PyTorch State Dict (.pt)",
      "description": "Real torch.save transformer weight dict with q_proj/v_proj/down_proj tensors.",
      "localPath": "/fixtures/v1/pt/transformer-state-dict.pt",
      "cdnUrl": "https://fileformat.co/fixtures/v1/pt/transformer-state-dict.pt",
      "sizeBytes": 2657,
      "sha256": "b927171a147cb843af3458e867b7972bca05a77969fd0d47f01f62fd32ef3c27",
      "expectValid": true
    },
    {
      "id": "pt-edge-case",
      "filename": "benign-pickle-canary.pt",
      "variant": "edge-case",
      "title": "PyTorch Pickle Security Audit Canary",
      "description": "Real torch.save archive containing an inert FILEFORMAT_CO_BENIGN_TEST_MARKER string — still loads with weights_only=True.",
      "localPath": "/fixtures/v1/pt/benign-pickle-canary.pt",
      "cdnUrl": "https://fileformat.co/fixtures/v1/pt/benign-pickle-canary.pt",
      "sizeBytes": 1641,
      "sha256": "06de6e85a3acdeaf03bfb30aac49b6d7e697bf8d63d6c6f7882228a5bde0dff7",
      "expectValid": true,
      "edgeCaseTag": "Benign Pickle Canary"
    }
  ]
}