PyTorch Model & Tensor Checkpoint
Default PyTorch `torch.save()` archive wrapping a Python Pickle instruction stream (`data.pkl`) alongside raw tensor storage files inside a ZIP container.
Since PyTorch 1.6+, `.pt` files use a PKZIP container (`archive/data.pkl`, `archive/version`, `archive/data/0`). Standard Pickle opcodes execute arbitrary Python callables unless `weights_only=True` is enforced.
Drop any .pt file (even 100 GB+) to inspect locally
Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded
.pt Magic Bytes & Header Offset Map
PyTorch ZIP archive header (disambiguated via archive/data.pkl)
| Byte Offset | Length | Data Type | Field Name | Engineering Description |
|---|---|---|---|---|
| 0x00 - 0x03 | 4 B | uint32_le | zip_magic | PKZIP local header 0x04034B50 |
| 0x1E+ | var | ascii | entry_path | Archive entry (e.g. archive/version or archive/data.pkl) |
.pt Security & Polyglot Risk Matrix
CRITICAL: Never call legacy torch.load() without weights_only=True on untrusted .pt/.pth uploads—Pickle GLOBAL/REDUCE opcodes enable instant RCE. Prefer SafeTensors.
Read .pt Header & Metadata Without Heavy Dependencies
import sys, zipfile
with zipfile.ZipFile(sys.argv[1], "r") as zf:
names = zf.namelist()
has_pkl = any(n.endswith("data.pkl") for n in names)
print(f"PyTorch ZIP entries={len(names)}, has_pickle={has_pkl}")Deterministic .pt Sample Files & Edge Cases
minimal-checkpoint.pt
Real torch.save state dict (2 tensors) — loads cleanly via torch.load(weights_only=True).
curl -fsSL https://fileformat.co/fixtures/v1/pt/minimal-checkpoint.pt -o minimal-checkpoint.pt \
&& echo "64f990b860de211afe49a1c8c9627cf4da92d75f69a29a2cb85c06927c62720c minimal-checkpoint.pt" | shasum -a 256 -ctransformer-state-dict.pt
Real torch.save transformer weight dict with q_proj/v_proj/down_proj tensors.
curl -fsSL https://fileformat.co/fixtures/v1/pt/transformer-state-dict.pt -o transformer-state-dict.pt \
&& echo "b927171a147cb843af3458e867b7972bca05a77969fd0d47f01f62fd32ef3c27 transformer-state-dict.pt" | shasum -a 256 -cbenign-pickle-canary.pt
Real torch.save archive containing an inert FILEFORMAT_CO_BENIGN_TEST_MARKER string — still loads with weights_only=True.
curl -fsSL https://fileformat.co/fixtures/v1/pt/benign-pickle-canary.pt -o benign-pickle-canary.pt \
&& echo "06de6e85a3acdeaf03bfb30aac49b6d7e697bf8d63d6c6f7882228a5bde0dff7 benign-pickle-canary.pt" | shasum -a 256 -cRelated Specifications & Alternatives
Hugging Face's memory-safe, zero-copy tensor serialization format designed to replace Pickle-based PyTorch checkpoints without arbitrary code execution risks.
Self-contained binary model weight format for llama.cpp and local LLM inference engines, storing architecture KV metadata, BPE vocabulary, and quantized tensor blocks in a single mmap-ready file.
Cross-framework Protocol Buffers computation graph and weight format used by ONNX Runtime, TensorRT, and CoreML converters.