Gregor Ziegltrum
Gregor Ziegltrum is a Senior Consultant at TNG Technology Consulting, specializing in innovative AI solutions. His work spans building agentic systems, as well as benchmarking, training, and fine-tuning Large Language Models. Beyond project work, Gregor shares his expertise through talks and internal trainings on Python best practices and deep dives into quirky language features. Before joining TNG, he earned both his Bachelor’s and Master’s degrees in Informatics from TU Munich, where he developed a strong passion for Data, AI, and High-Performance Computing.
Session
Saving PyTorch tensors is a routine part of machine learning, from checkpointing mid-training to publishing final model weights on Hugging Face. But for years, the standard way to load those weights exposed anyone who did it to remote code execution. PyTorch 2.6 finally changed the default, and if you hit an UnpicklingError after upgrading, this talk explains exactly why that error exists. We go deep on PyTorch's Pickle-based serialization: how the Pickle virtual machine actually works, how an attacker can craft a .pt file that silently runs arbitrary code while returning the correct tensor, and what weights_only=True actually protects against and where its limits are. We then look at Safetensors, Hugging Face's alternative format, which sidesteps the problem entirely by replacing Pickle with a format so simple you can write your own parser in half an hour. Along the way we cover the real performance differences between the two approaches and what the right migration path looks like for existing codebases.