An Empirical Study of Safetensors' Usage Trends and Developers' Perceptions

Andrew Cotaj; Beatrice Casey; Joanna C. S. Santos; Kaia Damian

REVIEW 3 major objections 6 minor 75 references

An Empirical Study of Safetensors' Usage Trends and Developers' Perceptions

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Most safetensors adoptions on Hugging Face come from an automated conversion bot, not deliberate developer choices.

desk verdict Solid empirical study with a load-bearing sampling filter that makes the headline automation-share claim overbroad; worth a major revision, not a desk reject. read the letter →

arxiv 2501.02170 v1 pith:YLOL5DVF submitted 2025-01-04 cs.SE

Beatrice Casey , Kaia Damian , Andrew Cotaj , Joanna C. S. Santos This is my paper · ORCID

classification cs.SE

keywords safetensorsmodelserializationHuggingFacesupplychainsecurityempiricalsoftwareengineeringpullrequestmergeratedeveloperperceptionsautomatedconversiontool

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks how quickly and why developers on Hugging Face adopted safetensors, a serialization format designed to prevent malicious code execution when loading machine learning models. By analyzing commit histories of over a thousand model repositories and coding hundreds of developer discussions, it finds that adoption is real and growing, but most of the observed conversions were performed automatically by Hugging Face's own tool. The paper's central surprise is that the vast majority of the conversion tool's pull requests remain unmerged, and that many developers report problems with converted models. If correct, the finding reframes safetensors' rise as a story about automation and developer trust, not just enthusiasm for a safer format.

What carries the argument

The central mechanism is Hugging Face's safetensors format and its automated conversion tool, which opens pull requests that replace PyTorch's torch.save files with safetensors files. The study's engine is a three-part analysis: commit-history extraction from 1,032 Hugging Face repositories created before September 2022, a rule-based file-header classifier that identifies serialization formats by magic bytes and zip structure, and open coding of 418 sampled discussions from Stack Overflow, GitHub, and Hugging Face, with a Cohen's kappa of 0.88 for inter-rater agreement.

What would settle it

A concrete check is to run the same analysis on all Hugging Face model repositories, including those created after September 2022, and compute the percentage of safetensors-addition commits that come from the conversion tool; if that share is far below 95.7%, the paper's central claim about the tool's dominance does not generalize to newer models.

Watch

Extended reading notes

Core claim

Safetensors is gaining traction on Hugging Face, but the adoption observed among existing repositories is dominated by an automated pipeline: 95.7% of commits adding safetensors files were merges of pull requests opened by Hugging Face's conversion tool. Despite that, 83.5% of the tool's pull requests across the platform remain unmerged, and only 13.9% are merged overall, with internal Hugging Face PRs merging at 93% versus outside developers' much lower rate. Developer discussions show both a genuine appetite for safe serialization and recurring pain points, including loading errors and reports of models behaving differently after conversion, which undermines trust in the format and the tool. The paper concludes that automated conversion is the main engine of safetensors adoption so far, but that verification and reliability concerns remain the key bottleneck.

Load-bearing premise

The dataset only includes repositories created before September 2022 and last modified in 2024, so the adoption timeline and the 95.7% automation share describe only migration of pre-existing repositories; if developers of newer models adopted safetensors directly without the conversion tool, the tool's role is overstated and the measured shift is incomplete.

Editorial extensions

If this is right

Safetensors adoption in pre-existing Hugging Face repositories is largely an artifact of automated conversion, meaning the tool, not developer initiative, drove the measured shift.
Because 83.5% of conversion pull requests go unmerged, the real adoption bottleneck is developer acceptance and verification of converted models, not awareness of the format.
The high merge rate for Hugging Face staff PRs (93%) versus outside PRs suggests that organizational familiarity and responsibility strongly affect whether automated conversions are accepted.
Keeping old PyTorch files in 98.7% of converted repositories means the security benefit of conversion is diluted, since downstream users can still load the vulnerable originals.
Developers' reported model-fidelity problems after conversion, alongside their eagerness to learn the format, point to a need for better verification tooling and documentation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the tool's unmerged PRs reflect a lack of trusted verification, a testable extension is whether adding automatic fidelity checks (e.g., comparing model outputs before and after conversion) to the PR would raise merge rates.
The paper's dataset excludes repositories created after safetensors' release, so the 95.7% automation share likely overstates the tool's role among newer, safetensors-native models; re-running the analysis on the full hub snapshot would test that.
Keeping both model files side by side may create a split-brain problem where users accidentally load the outdated or unsafe file; a follow-up could measure which file downstream users actually load.
The reported 'model not working as expected' cases suggest a direct test: convert a set of models with the tool and compare hidden states, not just final outputs, to see if serialization changes weights or tied-weight handling.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a solid empirical study with one load-bearing sampling limitation the authors don't acknowledge, and one overinterpretation in the abstract. The data pipeline is detailed, the magic-byte identification is sensible, and the qualitative taxonomy is a genuine contribution. But the headline claim that 95.7% of safetensors adoptions were automated conversions only holds for repositories created before safetensors existed. Section III-C filters to repos created before September 2022 and last modified in 2024, which excludes every repo created after the format was released. Any direct adoption by newer repos is invisible, so the figure is really about migrations of pre-existing repos, not 'adoptions up to date.' That doesn't invalidate the study, but it changes the claim, and the findings summary doesn't carry the caveat.

What's new and good: it's the first large-scale measurement of safetensors adoption on Hugging Face, and it quantifies what many suspected—that the conversion bot drives most of the movement. The RQ3 merge-rate analysis is useful, especially the contrast between HF-staff PRs (93% merged) and everyone else (15.7%). The open-coding taxonomy with Cohen's kappa 0.88 is a reasonable qualitative contribution.

Soft spots, in order. The filter is the big one. The authors frame it as wanting to observe how existing repositories changed after safetensors was released, which is a legitimate question, but the results are presented as ecosystem-wide. The abstract's 'developers ignore the conversion tool's pull requests' is also stronger than the data: 83.5% unmerged doesn't mean ignored, since open PRs could be pending or consciously declined. A time-to-close analysis or an explicit check for comments would support the 'ignore' wording. Notably, the RQ3 corpus of 43,596 PRs is not filtered the same way, so the data to test the comparison exists but isn't used. Minor: 1,032 repos is a small slice of the nearly million models on the Hub, so the trend lines in Figure 6 should be read as describing that cohort, not the whole ecosystem.

Overall: the work is honest, the methods are appropriate, and the limitation is a scope issue rather than a fatal flaw. I'd bring this to a reading group to talk about sampling bias in repository studies.

Recommendation: send to peer review with major revisions. The authors should re-run or stratify the sample, or at least qualify the automation-share claim, and soften the 'ignore' language. It deserves referee time.

Referee Report

3 major / 6 minor

Summary. The paper investigates the adoption of safetensors on Hugging Face, combining a quantitative analysis of commit histories and conversion-tool pull requests with a qualitative open-coding analysis of developer discussions. The quantitative part filters Hugging Face model repositories to those created before September 2022 and last modified in 2024, yielding 1,032 repositories, and finds 418 commits adding safetensors files, 95.7% of which merge PRs created by Hugging Face's conversion tool. The same filtered set underlies the adoption-trend analysis (RQ2). The PR analysis (RQ3) reports that 83.5% of conversion-tool PRs remain open and only 13.9% are merged. The qualitative part (RQ4) codes 418 sampled posts/PRs/discussions and produces a taxonomy of developer perceptions, including loading difficulties, performance concerns, and security awareness. The paper concludes that safetensors is gaining traction but that most adoption is automated while most developers do not merge the conversion tool's PRs.

Significance. If the findings hold, the paper provides a useful empirical baseline for how a security-motivated serialization format spreads through a large ML model hub, and it makes a credible contribution to the software-engineering literature on ecosystem evolution and secure development practices. Strengths include a detailed data-collection pipeline, an explicit rule-based format-identification method inherited from prior validated work, a replication package, and inter-rater reliability (Cohen's kappa = 0.88) for the qualitative coding. The paper is also careful in several places, for example in distinguishing the conversion-tool PR set from the repository-commit set. However, the central quantitative claims are currently stated more strongly than the data support: the sample filter excludes all repositories created after safetensors was released, and the PR-status analysis conflates 'unmerged' with 'ignored'. Both issues are load-bearing for the abstract and for RQ1/RQ3 conclusions, so the contribution is significant but conditional on the authors either broadening the analysis or qualifying the claims.

major comments (3)

[Abstract and §IV-C (RQ3)] The repository filter in Section III-C restricts the analysis to repositories created before September 2022 and last modified in 2024. Because safetensors was released in September 2022, this excludes every repository created after the format existed. The 418 safetensors-adding commits and the 95.7% automation share in Section IV-A therefore characterize only migration of pre-existing repositories, not 'most safetensor adoptions up to date' as stated in the RQ1 findings and the abstract. Repositories created after September 2022 that adopt safetensors at creation time are invisible to this analysis, and a newer format is plausibly more likely to appear in newer repositories. Since the RQ3 corpus of 43,596 PRs is not subject to the same filter, the data needed to test the comparison exist but are not used in RQ1. The authors should either re-run the analysis on an unrestricted repository set or explicitly restate the claims as applying only to repositories that predate safetensors; without this change, the headline percentages are an overgeneralization.
[Abstract and §IV-C (RQ3)] The paper equates 'unmerged' PRs with PRs that developers 'ignore.' Figure 7 reports that 83.5% of conversion-tool PRs remain open and 13.9% are merged; an open PR may be pending review, awaiting the repository owner's decision, or intentionally left for later, none of which is the same as being ignored. The abstract's claim that 'a majority of developers ignore the conversion tool's pull requests' is therefore not supported by the reported status data. The authors should report the open/closed/merged breakdown separately and qualify the interpretation of open PRs, or present evidence (for example, PR age or absence of any activity) to support the 'ignore' framing.
[§III-F and §III-G] The PR counts in Section III are internally inconsistent. Section III-F states that the crawler extracted 43,596 PR URLs and that after retrieving their web pages it obtained 43,248 PRs; Section III-G then states that after merging duplicates and filtering out PRs without metadata and internal bot activity, the final set was 43,596 PRs. Since the filtering steps can only reduce the count, the post-filter total cannot exceed the pre-filter total. This discrepancy affects the reported RQ3 totals and the percentages derived from them; the authors should correct the numbers and verify that the RQ3 statistics are computed on the correct final dataset.

minor comments (6)

[§II-B (Listing 1)] Listing 1 contains a typo, 'toch.save', which should read 'torch.save'.
[§II-A] The word 'deserializaiton' is misspelled and should be 'deserialization'.
[§I] The Introduction contains a duplicated word: 'democratize and and further advance'.
[§IV-A] The sentence '394 repositories (98.7%) still kept their old PyTorch model files' does not specify the denominator; the authors should state explicitly how many repositories or commits this percentage is based on.
[§III-I and §III-J] The description of the RQ4 sampling is confusing: the paper samples 159 StackOverflow posts, 352 GitHub PRs, and 24 Hugging Face discussions, but then reports 'we obtained a total of 418 posts/discussions/PRs to analyze' without clarifying whether 418 is before or after the true-positive filtering step.
[§IV-A] The RQ1 findings summary states 'Most of safetensor adoptions (95.7%) up to date' without specifying the data cut-off date or the sample restriction; adding 'among repositories created before September 2022' and the query date would avoid overstatement.

Circularity Check

0 steps flagged · score 1.0 of 10

No circular derivation: the safetensors adoption percentages are direct measurements of external Hugging Face data; the only self-citation is a non-load-bearing reuse of magic-byte identification rules from the authors' prior work.

full rationale

This paper is an observational empirical study, not a derivation chain. RQ1's central figure (95.7%) is a count of commits in the filtered repository set that merge Hugging Face conversion-tool PRs: Section IV-A states 'most of them (95.7%) were commits to merge the pull requests made by Hugging Face's conversion tool.' The count is computed from commit logs, not from a fitted parameter, and the denominator is the set of commits adding safetensors files. RQ2's trend is a yearly tabulation of last commits per repository; RQ3's 83.5% is a merge-status tabulation of 43,596 PRs; RQ4 is qualitative open coding. No quantity is defined in terms of another measured quantity, so no self-definitional or fitted-input-as-prediction pattern applies. The paper's only substantive overlap with prior work by the same authors is methodological: Section III-E says 'similar to a prior work [16], we employ a rule-based algorithm to identify the serialization method.' The rules are restated in the paper and are public file-format signatures, so the citation is not the load-bearing justification for the results. The Section III-C filter (repositories created before September 2022, last modified 2024) is a sampling-scope limitation that could affect the unqualified phrase 'up to date' in RQ1, but it does not make the reported percentages true by construction. Therefore no circular step is present; the score is 1 only to acknowledge the minor, non-load-bearing self-citation.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The central quantitative claims rest on three domain assumptions: the filtered repository set represents the ecosystem, magic-byte rules identify formats correctly, and unmerged PR status means rejection. None of these is validated against an external benchmark in the paper.

assumptions (3)

domain assumption Model repositories created before September 2022 and last modified in 2024 are representative of safetensors adoption on Hugging Face.
Section III-C filters the entire population of 996,939 repos to 1,032; new repos that could adopt safetensors directly are excluded.
domain assumption Magic-byte rules R1-R5 correctly identify the serialization format of model files.
Section III-E: format identification relies on file header heuristics; misclassified zipped or pickle files would affect counts.
domain assumption Unmerged pull requests indicate developers did not accept the conversion tool (interpreted as ignoring).
Section IV-C: open PR status is mapped to developer disinterest or lack of trust, though open may also mean pending.

how reviews work

0 comments

Cite this review

Pith. "Pith review of An Empirical Study of Safetensors' Usage Trends and Developers' Perceptions." pith.science (2026). https://pith.science/paper/YLOL5DVF

@misc{pith2026250102170,
  author       = {Pith},
  title        = {Pith review of: An Empirical Study of Safetensors' Usage Trends and Developers' Perceptions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YLOL5DVF}},
  note         = {Machine review of arXiv:2501.02170}
}

read the original abstract

Developers are sharing pre-trained Machine Learning (ML) models through a variety of model sharing platforms, such as Hugging Face, in an effort to make ML development more collaborative. To share the models, they must first be serialized. While there are many methods of serialization in Python, most of them are unsafe. To tame this insecurity, Hugging Face released safetensors as a way to mitigate the threats posed by unsafe serialization formats. In this context, this paper investigates developer's shifts towards using safetensors on Hugging Face in an effort to understand security practices in the ML development community, as well as how developers react to new methods of serialization. Our results find that more developers are adopting safetensors, and many safetensor adoptions were made by automated conversions of existing models by Hugging Face's conversion tool. We also found, however, that a majority of developers ignore the conversion tool's pull requests, and that while many developers are facing issues with using safetensors, they are eager to learn about and adapt the format.

Figures

Figures reproduced from arXiv: 2501.02170 by the authors.

**Figure 2.** Safetensor serialization format D. Hugging Face’s Safetensor Conversion Tool Hugging Face has an online tool [15] that provides a userfriendly way to convert models serialized using PyTorch to the safetensors format. The conversion process is straightforward: developers specify the URL to their repository containing the serialized model in the PyTorch format, and the tool [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Study Overview A. Research Questions This paper answers the following research questions: RQ1 How long it took developers to adopt safetensors in their projects? While safetensors was first released in September 2022 [24], we do not currently have an understanding of how fast safetensors was adopted as a serialization format for models. In this question, we aim to understand when developers began using safetensors i… view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: RQ1: Calendar view of commits adding model serialized using safetensors on Hugging Face since September 2022 [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: RQ1: Distribution of commits made using Hugging Face’s conversion tool [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 6.** Figure 6: Trend of serialization methods used over the years [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: RQ3: Distribution of PR Status Across Different Repositories [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

**Figure 8.** Figure 8: Taxonomy of Developers’ Perceptions Additionally, developers are exploring ways to enhance the organization and accessibility of their models by creating or modifying safetensors’ index JSON files. These indexed JSON files act as guides to the structure and content of …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

75 extracted references · 74 canonical work pages

[1]

Hugging Face – The AI community building the future

Hugging Face, “Hugging Face – The AI community building the future..” https://huggingface.co, Aug. 2024. [Online; accessed 2. Aug. 2024]

work page 2024
[2]

Codeﬁll: Multi-token code completion by jointly learning from structure and naming sequences,

M. Izadi, R. Gismondi, and G. Gousios, “Codeﬁll: Multi-token code completion by jointly learning from structure and naming sequences,” in 44th International Conference on Software Engineering (ICSE) , 2022

work page 2022
[3]

Code prediction by feeding trees to transformers,

S. Kim, J. Zhao, Y . Tian, and S. Chandra, “Code prediction by feeding trees to transformers,” in 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) , pp. 150–162, IEEE, 2021

work page 2021
[4]

Fast and memory-efﬁcient neural code completion,

A. Svyatkovskiy, S. Lee, A. Hadjitoﬁ, M. Riechert, J. V . Franco, and M. Allamanis, “Fast and memory-efﬁcient neural code completion,” in 2021 IEEE/ACM 18th International Conference on Mining Software Repositories (MSR) , pp. 329–340, IEEE, 2021

work page 2021
[5]

M2ts: Multi-scale multi-modal approach based on transformer for source code summarization,

Y . Gao and C. Lyu, “M2ts: Multi-scale multi-modal approach based on transformer for source code summarization,” in Proceedings of the 30th IEEE/ACM International Conference on Program Comprehension , ICPC ’22, (New Y ork, NY , USA), p. 24–35, Association for Computing Machinery, 2022

work page 2022
[6]

Evaluating large language models trained on code,

M. Chen, J. Tworek, H. Jun, Q. Y uan, H. P . de Oliveira Pinto, et al. , “Evaluating large language models trained on code,” 2021

work page 2021
[7]

An empirical study of pre-trained model reuse in the hugging face deep learning model registry,

W. Jiang, N. Synovic, M. Hyatt, T. R. Schorlemmer, R. Sethi, Y .-H. Lu, G. K. Thiruvathukal, and J. C. Davis, “An empirical study of pre-trained model reuse in the hugging face deep learning model registry,” 2023

work page 2023
[8]

Enhancing the interoperability between deep learning frameworks by model conversion,

Y . Liu, C. Chen, R. Zhang, T. Qin, X. Ji, H. Lin, and M. Y ang, “Enhancing the interoperability between deep learning frameworks by model conversion,” in Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the F oundations of Software Engineering, ESEC/FSE 2020, (New Y ork, NY , USA), p. 1320–1330, Assoc...

work page 2020

Show all 75 references

[9]

How to make hugging face to hug worms: Discovering and exploiting unsafe pickle.loads over pre-trained large model hubs,

P . Zhou, “How to make hugging face to hug worms: Discovering and exploiting unsafe pickle.loads over pre-trained large model hubs,” 2024

2024
[10]

An empirical study of artifacts and security risks in the pre-trained model supply chain,

W. Jiang, N. Synovic, R. Sethi, A. Indarapu, M. Hyatt, T. R. Schor- lemmer, G. K. Thiruvathukal, and J. C. Davis, “An empirical study of artifacts and security risks in the pre-trained model supply chain,” in Proceedings of the 2022 ACM Workshop on Software Supply Chain Offens...

2022
[11]

Pain pickle: Bypassing python restricted unpickler for automatic exploit generation,

N.-J. Huang, C.-J. Huang, and S.-K. Huang, “Pain pickle: Bypassing python restricted unpickler for automatic exploit generation,” in 2022 IEEE 22nd International Conference on Software Quality, Reliability and Security (QRS) , pp. 1079–1090, 2022

2022
[12]

Sour pickles: Shellcoding in python’s serialisation for- mat, 2011

M. Slaviero, “Sour pickles: Shellcoding in python’s serialisation for- mat, 2011.” https://media.blackhat.com/bh-us-11/Slaviero/BH US 11 Slaviero Sour Pickles WP .pdf, 2011. [Accessed 02-08-2024]

2011
[13]

Safetensors — huggingface.co,

Hugging Face, “Safetensors — huggingface.co,” 2024. [Accessed 01- 08-2024]

2024
[14]

Eleutherai, hugging face safetensors library. security assessment

F. Dahlgren, S. Hussain, H. Khlaaf, , and E. Sultanik, “Eleutherai, hugging face safetensors library. security assessment.” https://huggingface.co/datasets/safetensors/trail of bits audit repot/ blob/main/SOW-TrailofBits-EleutherAI HuggingFace-v1.2.pdf, May
[15]

Convert to Safetensors - a Hugging Face Space by safetensors

“Convert to Safetensors - a Hugging Face Space by safetensors.” https://huggingface.co/spaces/safetensors/convert, Nov. 2024. [Online; accessed 3. Nov. 2024]

2024
[16]

A large-scale exploit instru- mentation study of ai/ml supply chain attacks in hugging face models,

B. Casey, J. Santos, and M. Mirakhorli, “A large-scale exploit instru- mentation study of ai/ml supply chain attacks in hugging face models,” arXiv preprint arXiv:2410.04490 , 2024

2024 arXiv
[17]

Anonymous Github — anonymous.4open.science

Anonymous, “Anonymous Github — anonymous.4open.science.” https://anonymous.4open.science/r/wip-model-evolution-DCBD/ README.md, 2024. [Accessed 11-11-2024]

2024
[18]

Object serialization analysis and comparison in java and .net,

M. Hericko, M. B. Juric, I. Rozman, S. Beloglavec, and A. Zivkovic, “Object serialization analysis and comparison in java and .net,” SIG- PLAN Not. , vol. 38, p. 44–54, aug 2003

2003
[19]

Seneca: Taint-based call graph construction for java object deserialization,

J. C. Santos, M. Mirakhorli, and A. Shokri, “Seneca: Taint-based call graph construction for java object deserialization,” Proceedings of the ACM on Programming Languages , vol. 8, no. OOPSLA1, pp. 1125– 1153, 2024

2024
[20]

Salsa: static analysis of serialization features,

J. C. S. Santos, R. A. Jones, and M. Mirakhorli, “Salsa: static analysis of serialization features,” in Proceedings of the 22nd ACM SIGPLAN International Workshop on F ormal Techniques for Java-Like Programs , FTfJP ’20, (New Y ork, NY , USA), p. 18–25, Association for Computi...

2020
[21]

Serialization-aware call graph construction,

J. C. Santos, R. A. Jones, C. Ashiogwu, and M. Mirakhorli, “Serialization-aware call graph construction,” in Proceedings of the 10th ACM SIGPLAN International Workshop on the State of the Art in Program Analysis , pp. 37–42, 2021

2021
[22]

Serialization in object- oriented programming languages,

K. Grochowski, M. Breiter, and R. Nowak, “Serialization in object- oriented programming languages,” in Introduction to data science and machine learning , pp. 1–18, IntechOpen, 2019

2019
[23]

The top programming languages 2024,

S. Cass, “The top programming languages 2024,” Aug. 2024

2024
[24]

Safetensors Releases

“Safetensors Releases.” https://github.com/huggingface/safetensors/ releases, Sept. 2022. [Online; accessed 1. Nov. 2024]

2022
[25]

Repositories

“Repositories.” https://huggingface.co/docs/hub/repositories, Nov. 2024. [Online; accessed 1. Nov. 2024]

2024
[26]

HfApi Client,

“HfApi Client,” Aug. 2024. [Online; accessed 2. Aug. 2024]

2024
[27]

Hub API Endpoints,

“Hub API Endpoints,” Oct. 2024. [Online; accessed 10. Oct. 2024]

2024
[28]

numpy.lib.format 2014; NumPy v2.0 Manual — numpy.org

NumPy Developers, “numpy.lib.format 2014; NumPy v2.0 Manual — numpy.org.” https://numpy.org/doc/stable/reference/generated/numpy.lib. format.html, 2024. [Accessed 01-08-2024]

2014
[29]

Hdf5, hierarchical data format, version 5

“Hdf5, hierarchical data format, version 5.” https://www.loc.gov/ preservation/digital/formats/fdd/fdd000229.shtml. [Online; accessed 2. Aug. 2024]

2024
[30]

safetensors/conversions · Datasets at Hugging Face

“safetensors/conversions · Datasets at Hugging Face.” https://huggingface.co/datasets/safetensors/conversions, Nov. 2024. [Online; accessed 10. Nov. 2024]

2024
[31]

SFconvertbot (Safetensors convertbot)

“SFconvertbot (Safetensors convertbot).” https://huggingface.co/SFconvertbot/activity/community, Nov. 2024. [Online; accessed 10. Nov. 2024]

2024
[32]

SFconvertbot (Safetensors convertbot)

“SFconvertbot (Safetensors convertbot).” https://huggingface.co/ SFconvertbot, Nov. 2024. [Online; accessed 1. Nov. 2024]

2024
[33]

Stack exchange api

“Stack exchange api.” https://api.stackexchange.com, 2024. [Online; accessed 27 Oct. 2024]

2024
[34]

Github rest api documentation

“Github rest api documentation.” https://docs.github.com/en/rest? apiV ersion=2022-11-28, 2024. [Online; accessed 27 Oct. 2024]

2022
[35]

Safetensors Convert Discussions

“Safetensors Convert Discussions.” https://huggingface.co/spaces/ safetensors/convert/discussions, Nov. 2024. [Online; accessed 1. Nov. 2024]

2024
[36]

A statistical interpretation of term speciﬁcity and its application in retrieval,

K. Sparck Jones, “A statistical interpretation of term speciﬁcity and its application in retrieval,” Journal of documentation , vol. 28, no. 1, pp. 11–21, 1972

1972
[37]

Glaser and A

B. Glaser and A. Strauss, The Discovery of Grounded Theory: Strategies for Qualitative Research . Observations (Chicago, Ill.), Aldine, 1967

1967
[38]

Glaser, Emergence Vs F orcing: Basics of Grounded Theory Analysis

B. Glaser, Emergence Vs F orcing: Basics of Grounded Theory Analysis . Emergence vs. forcing, Sociology Press, 1992

1992
[39]

Interrater reliability: The kappa statistic,

M. McHugh, “Interrater reliability: The kappa statistic,” Biochemia medica : ˇcasopis Hrvatskoga dru ˇstva medicinskih biokemi ˇcara / HDMB , vol. 22, pp. 276–82, 10 2012

2012
[40]

Hijacking safetensors conversion on hugging face — hid- denlayer,

K. Sestito, “Hijacking safetensors conversion on hugging face — hid- denlayer,” Feb. 2024

2024
[41]

State of competitive machine learning in 2022,

H. Carlens, “State of competitive machine learning in 2022,” ML Contests Research , 2023. https://mlcontests.com/state-of-competitive- machine-learning-2022/

2022
[42]

Onnx news

“Onnx news.” https://onnx.ai/news.html, 2024. [Online; accessed 30 Oct. 2024]

2024
[43]

Serialize JAX, Flax, Haiku, or Objax model params with safetensors

“Serialize JAX, Flax, Haiku, or Objax model params with safetensors.” https://github.com/alvarobartt/safejax, Dec. 2022. [Online; accessed 1. Nov. 2024]

2022
[44]

Flax: A neural network library and ecosystem for JAX designed for ﬂexibility

“Flax: A neural network library and ecosystem for JAX designed for ﬂexibility.” https://github.com/google/ﬂax, Mar. 2020. [Online; accessed

2020
[45]

compressed-tensors,

neuralmagic, “compressed-tensors,” Apr. 2024

2024
[46]

“LoRA.” https://huggingface.co/docs/diffusers/en/training/lora, Nov
[47]

“Docker.” https://www.docker.com, Nov. 2024. [Online; accessed 1. Nov. 2024]

2024
[48]

A hybrid analysis to detect java serialisation vulnerabilities,

S. Rasheed and J. Dietrich, “A hybrid analysis to detect java serialisation vulnerabilities,” in Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering , ASE ’20, (New Y ork, NY , USA), p. 1209–1213, Association for Computing Machinery, 2021

2021
[49]

An in-depth study of more than ten years of java exploitation,

P . Holzinger, S. Triller, A. Bartel, and E. Bodden, “An in-depth study of more than ten years of java exploitation,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , CCS ’16, (New Y ork, NY , USA), p. 779–790, Association for Computin...

2016
[50]

Automated discovery of deserialization gadget chains,

I. Haken, “Automated discovery of deserialization gadget chains,” 2018

2018
[51]

Evil pickles: Dos attacks based on object-graph engineering,

J. Dietrich, K. Jezek, A. Rasheed, S. Tahir, and A. Potanin, “Evil pickles: Dos attacks based on object-graph engineering,” 2017

2017
[52]

Object injection vulnerability discovery based on latent semantic indexing,

H. Shahriar and H. Haddad, “Object injection vulnerability discovery based on latent semantic indexing,” in Proceedings of the 31st Annual ACM Symposium on Applied Computing , SAC ’16, (New Y ork, NY , USA), p. 801–807, Association for Computing Machinery, 2016

2016
[53]

Objectmap: detecting insecure object deserialization,

N. Koutroumpouchos, G. Lavdanis, E. V eroni, C. Ntantogian, and C. Xenakis, “Objectmap: detecting insecure object deserialization,” in Proceedings of the 23rd Pan-Hellenic Conference on Informatics , PCI ’19, (New Y ork, NY , USA), p. 67–72, Association for Computing Machinery, 2019

2019
[54]

One class to rule them all 0-day deserialization vulnerabilities in android,

O. Peles and R. Hay, “One class to rule them all 0-day deserialization vulnerabilities in android,” in Proceedings of the 9th USENIX Con- ference on Offensive Technologies , WOOT’15, (USA), p. 5, USENIX Association, 2015

2015
[55]

Pwning your java messaging with deserialization vulnerabilities

M. Kaiser, “Pwning your java messaging with deserialization vulnerabilities.” https://www.blackhat.com/docs/us-16/materials/ us-16-Kaiser-Pwning-Y our-Java-Messaging-With-Deserialization-Vulnerabilities-wp. pdf, Aug. 2016

2016
[56]

Serialdetector: Principled and practical exploration of object injection vulnerabilities for the web

M. Shcherbakov and M. Balliu, “Serialdetector: Principled and practical exploration of object injection vulnerabilities for the web.”
[57]

Code reuse attacks in php: Automated pop chain generation,

J. Dahse, N. Krein, and T. Holz, “Code reuse attacks in php: Automated pop chain generation,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , CCS ’14, (New Y ork, NY , USA), p. 42–53, Association for Computing Machinery, 2014

2014
[58]

Quack: Hindering deserialization attacks via static duck typing,

Y . David, N. Christou, A. D. Kellas, V . P . Kemerlis, and J. Y ang, “Quack: Hindering deserialization attacks via static duck typing,” Proceedings 2024 Network and Distributed System Security Symposium , 2024

2024
[59]

The evolution of project inter-dependencies in a software ecosystem: The case of apache,

G. Bavota, G. Canfora, M. D. Penta, R. Oliveto, and S. Panichella, “The evolution of project inter-dependencies in a software ecosystem: The case of apache,” in 2013 IEEE International Conference on Software Maintenance, pp. 280–289, 2013

2013
[60]

How the apache community upgrades dependencies: an evolutionary study,

G. Bavota, G. Canfora, M. Di Penta, R. Oliveto, and S. Panichella, “How the apache community upgrades dependencies: an evolutionary study,” Empirical Software Engineering , vol. 20, pp. 1275–1317, Oct 2015

2015
[61]

Data model evolution using object-nosql mappers: folklore or state-of-the-art?,

A. Ringlstetter, S. Scherzinger, and T. F. Bissyand ´e, “Data model evolution using object-nosql mappers: folklore or state-of-the-art?,” in Proceedings of the 2nd International Workshop on BIG Data Software Engineering, BIGDSE ’16, (New Y ork, NY , USA), p. 33–36, Associa- ti...

2016
[62]

A preliminary study of rhythm and speed in the maven ecosystem,

D. Jaime, J. El Haddad, and P . Poizat, “A preliminary study of rhythm and speed in the maven ecosystem,” in 21st Belgium-Netherlands Software Evolution Workshop , CEUR-WS.org, Sep 2022

2022
[63]

Analyzing software repositories to understand software evolution,

M. D’Ambros, H. C. Gall, M. Lanza, and M. Pinzger, “Analyzing software repositories to understand software evolution,” in Software Evolution, pp. 1–38, Springer, 2008

2008
[64]

Leveraging large language models for software model completion: Results from industrial and public datasets,

C. Tinnes, A. Welter, and S. Apel, “Leveraging large language models for software model completion: Results from industrial and public datasets,” 2024

2024
[65]

Security and privacy challenges in deep learning models,

G. Golla, “Security and privacy challenges in deep learning models,” 2023

2023
[66]

Advanced query optimization in sql databases for real-time big data analytics,

M. M. Rahman, S. Islam, M. Kamruzzaman, and Z. H. Joy, “Advanced query optimization in sql databases for real-time big data analytics,” Academic Journal on Business Administration, Innovation & Sustain- ability, vol. 4, p. 1–14, Jun. 2024

2024
[67]

Improving query efﬁciency in heterogeneous big data environments through advanced query processing techniques,

F. Ibrahim and M. Aoun, “Improving query efﬁciency in heterogeneous big data environments through advanced query processing techniques,” Journal of Contemporary Healthcare Analytics , vol. 6, p. 40–64, Jun. 2022

2022
[68]

Simtrojan: Stealthy backdoor attack,

Y . Ren, L. Li, and J. Zhou, “Simtrojan: Stealthy backdoor attack,” in 2021 IEEE International Conference on Image Processing (ICIP) , pp. 819–823, 2021

2021
[69]

Stealthy backdoor attack for code models,

Z. Y ang, B. Xu, J. M. Zhang, H. J. Kang, J. Shi, J. He, and D. Lo, “Stealthy backdoor attack for code models,” IEEE Transactions on Software Engineering , vol. 50, no. 4, pp. 721–741, 2024

2024
[70]

Deep learning model reuse in the huggingface community: Challenges, beneﬁt and trends,

M. Taraghi, G. Dorcelus, A. Foundjem, F. Tambon, and F. Khomh, “Deep learning model reuse in the huggingface community: Challenges, beneﬁt and trends,” 2024

2024
[71]

An empirical study on bugs inside pytorch: A replication study,

S. C. Yin Ho, V . Majdinasab, M. Islam, D. E. Costa, E. Shihab, F. Khomh, S. Nadi, and M. Raza, “An empirical study on bugs inside pytorch: A replication study,” in 2023 IEEE International Conference on Software Maintenance and Evolution (ICSME) , pp. 220–231, 2023

2023
[72]

Guidelines for conducting and reporting case study research in software engineering,

P . Runeson and M. H ¨ost, “Guidelines for conducting and reporting case study research in software engineering,” Empirical Softw. Engg. , 2009

2009
[73]

A coefﬁcient of agreement for nominal scales,

J. Cohen, “A coefﬁcient of agreement for nominal scales,” Educational and Psychological Measurement , 1960

1960
[2023]

[Accessed 07-11-2024]

2024
[2024]

[Online; accessed 1. Nov. 2024]

2024

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

Hugging Face – The AI community building the future

Hugging Face, “Hugging Face – The AI community building the future..” https://huggingface.co, Aug. 2024. [Online; accessed 2. Aug. 2024]

work page 2024

[2] [2]

Codeﬁll: Multi-token code completion by jointly learning from structure and naming sequences,

M. Izadi, R. Gismondi, and G. Gousios, “Codeﬁll: Multi-token code completion by jointly learning from structure and naming sequences,” in 44th International Conference on Software Engineering (ICSE) , 2022

work page 2022

[3] [3]

Code prediction by feeding trees to transformers,

S. Kim, J. Zhao, Y . Tian, and S. Chandra, “Code prediction by feeding trees to transformers,” in 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) , pp. 150–162, IEEE, 2021

work page 2021

[4] [4]

Fast and memory-efﬁcient neural code completion,

A. Svyatkovskiy, S. Lee, A. Hadjitoﬁ, M. Riechert, J. V . Franco, and M. Allamanis, “Fast and memory-efﬁcient neural code completion,” in 2021 IEEE/ACM 18th International Conference on Mining Software Repositories (MSR) , pp. 329–340, IEEE, 2021

work page 2021

[5] [5]

M2ts: Multi-scale multi-modal approach based on transformer for source code summarization,

Y . Gao and C. Lyu, “M2ts: Multi-scale multi-modal approach based on transformer for source code summarization,” in Proceedings of the 30th IEEE/ACM International Conference on Program Comprehension , ICPC ’22, (New Y ork, NY , USA), p. 24–35, Association for Computing Machinery, 2022

work page 2022

[6] [6]

Evaluating large language models trained on code,

M. Chen, J. Tworek, H. Jun, Q. Y uan, H. P . de Oliveira Pinto, et al. , “Evaluating large language models trained on code,” 2021

work page 2021

[7] [7]

An empirical study of pre-trained model reuse in the hugging face deep learning model registry,

W. Jiang, N. Synovic, M. Hyatt, T. R. Schorlemmer, R. Sethi, Y .-H. Lu, G. K. Thiruvathukal, and J. C. Davis, “An empirical study of pre-trained model reuse in the hugging face deep learning model registry,” 2023

work page 2023

[8] [8]

Enhancing the interoperability between deep learning frameworks by model conversion,

Y . Liu, C. Chen, R. Zhang, T. Qin, X. Ji, H. Lin, and M. Y ang, “Enhancing the interoperability between deep learning frameworks by model conversion,” in Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the F oundations of Software Engineering, ESEC/FSE 2020, (New Y ork, NY , USA), p. 1320–1330, Assoc...

work page 2020