# CryptoTensors: A Light-Weight Large Language Model File Format for Highly-Secure Model Distribution Source: [CryptoTensors: A Light-Weight Large Language Model File Format for Highly-Secure Model Distribution]() Collection index: [llms.txt]() Data updated: 2025-12-10T05:02:30.085Z Authors: Huifeng Zhu, Shijie Li, Qinfeng Li, Yier Jin Published: 2025-12-04T08:49:22.000Z ## Abstract To enhance the performance of large language models (LLMs) in various domain-specific applications, sensitive data such as healthcare, law, and finance are being used to privately customize or fine-tune these models. Such privately adapted LLMs are regarded as either personal privacy assets or corporate intellectual property. Therefore, protecting model weights and maintaining strict confidentiality during deployment and distribution have become critically important. However, existing model formats and deployment frameworks provide little to no built-in support for confidentiality, access control, or secure integration with trusted hardware. Current methods for securing model deployment either rely on computationally expensive cryptographic techniques or tightly controlled private infrastructure. Although these approaches can be effective in specific scenarios, they are difficult and costly for widespread deployment. In this paper, we introduce CryptoTensors, a secure and format-compatible file structure for confidential LLM distribution. Built as an extension to the widely adopted Safetensors format, CryptoTensors incorporates tensor-level encryption and embedded access control policies, while preserving critical features such as lazy loading and partial deserialization. It enables transparent decryption and automated key management, supporting flexible licensing and secure model execution with minimal overhead. We implement a proof-of-concept library, benchmark its performance across serialization and runtime scenarios, and validate its compatibility with existing inference frameworks, including Hugging Face Transformers and vLLM. Our results highlight CryptoTensors as a light-weight, efficient, and developer-friendly solution for safeguarding LLM weights in real-world and widespread deployments. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Qwen3 Family Inference Performance (PyTorch Workflow)](): LLM Inference; Transformers (PyTorch) workflow Qwen3 family (inference); Model Load Time (s): 1.16. - [vLLM Inference Performance on Qwen3-0.6B](): vLLM Model Deployment and Inference; Qwen3-0.6B vLLM inference; Model Load Time (s): 0.34. - [vLLM Inference Performance on Qwen3-1.7B](): vLLM Model Deployment and Inference; Qwen3-1.7B vLLM (inference); Model Load Time (s): 0.594. - [vLLM Inference Performance on Qwen3-4B](): vLLM Model Deployment and Inference; Qwen3-4B vLLM (inference); Model Load Time (s): 1.104. - [vLLM Inference Performance on Qwen3-8B](): vLLM Model Deployment and Inference; Qwen3-8B vLLM inference; Model Load Time (s): 1.806. - [vLLM Inference Performance on Qwen3-14B](): vLLM Model Deployment and Inference; Qwen3-14B vLLM (inference); Model Load Time (s): 3.165. - [vLLM Inference Performance on Qwen3-32B](): vLLM Model Deployment and Inference; Qwen3-32B inference vLLM; Model Load Time (s): 7.668. ## Original sources and implementation [Original paper]() [PDF]()