Skip to content

Safe model serialization: Support saving pytorch model via torch.export.save#19692

Merged
WeichenXu123 merged 17 commits intomlflow:masterfrom
WeichenXu123:torch-safe-save
Jan 15, 2026
Merged

Safe model serialization: Support saving pytorch model via torch.export.save#19692
WeichenXu123 merged 17 commits intomlflow:masterfrom
WeichenXu123:torch-safe-save

Conversation

@WeichenXu123
Copy link
Collaborator

@WeichenXu123 WeichenXu123 commented Dec 30, 2025

🛠 DevTools 🛠

Open in GitHub Codespaces

Install mlflow from this PR

# mlflow
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/19692/merge
# mlflow-skinny
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/19692/merge#subdirectory=libs/skinny

For Databricks, use the following command:

%sh curl -LsSf https://raw.githubusercontent.com/mlflow/mlflow/HEAD/dev/install-skinny.sh | sh -s pull/19692/merge

Related Issues/PRs

#xxx

What changes are proposed in this pull request?

Support saving pytorch model via torch.export.save

This is a safe serialization format, it avoids pickling Module instance, instead, it traces the module as graph , and then serialize the graph and the state_dict (weights / buffers).

A new param export_model for pytorch flavor log_model / save_model is added

How is this PR tested?

  • Existing unit/integration tests
  • New unit/integration tests
  • Manual tests

Does this PR require documentation update?

  • No. You can skip the rest of this section.
  • Yes. I've updated:
    • Examples
    • API references
    • Instructions

Release Notes

Is this a user-facing change?

  • No. You can skip the rest of this section.
  • Yes. Give a description of this change to be included in the release notes for MLflow users.

Safe model serialization: Support saving pytorch model via torch.export.save

What component(s), interfaces, languages, and integrations does this PR affect?

Components

  • area/tracking: Tracking Service, tracking client APIs, autologging
  • area/models: MLmodel format, model serialization/deserialization, flavors
  • area/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registry
  • area/scoring: MLflow Model server, model deployment tools, Spark UDFs
  • area/evaluation: MLflow model evaluation features, evaluation metrics, and evaluation workflows
  • area/gateway: MLflow AI Gateway client APIs, server, and third-party integrations
  • area/prompts: MLflow prompt engineering features, prompt templates, and prompt management
  • area/tracing: MLflow Tracing features, tracing APIs, and LLM tracing functionality
  • area/projects: MLproject format, project running backends
  • area/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev server
  • area/build: Build and test infrastructure for MLflow
  • area/docs: MLflow documentation pages

How should the PR be classified in the release notes? Choose one:

  • rn/none - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
  • rn/breaking-change - The PR will be mentioned in the "Breaking Changes" section
  • rn/feature - A new user-facing feature worth mentioning in the release notes
  • rn/bug-fix - A user-facing bug fix worth mentioning in the release notes
  • rn/documentation - A user-facing documentation change worth mentioning in the release notes

Should this PR be included in the next patch release?

Yes should be selected for bug fixes, documentation updates, and other small changes. No should be selected for new features and larger changes. If you're unsure about the release classification of this PR, leave this unchecked to let the maintainers decide.

What is a minor/patch release?
  • Minor release: a release that increments the second part of the version number (e.g., 1.2.0 -> 1.3.0).
    Bug fixes, doc updates and new features usually go into minor releases.
  • Patch release: a release that increments the third part of the version number (e.g., 1.2.0 -> 1.2.1).
    Bug fixes and doc updates usually go into patch releases.
  • Yes (this PR will be cherry-picked and included in the next patch release)
  • No (this PR will be included in the next minor release)

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
@github-actions github-actions bot added area/models MLmodel format, model serialization/deserialization, flavors rn/feature Mention under Features in Changelogs. labels Dec 30, 2025
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds support for safe PyTorch model serialization using torch.export.save, which addresses security vulnerabilities associated with the CloudPickle format by tracing models as computation graphs rather than pickling Module instances.

Key Changes:

  • Adds new export_model boolean parameter to mlflow.pytorch.log_model() and mlflow.pytorch.save_model() functions
  • Implements model export logic with dynamic shape inference support
  • Updates model loading to handle both traditional pickle-based and exported (pt2) model formats

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 8 comments.

File Description
mlflow/pytorch/__init__.py Implements core functionality for exporting models via torch.export.save, adds validation logic, and updates model loading to detect and handle exported models
tests/pytorch/test_pytorch_model_export.py Adds comprehensive test coverage for exported model saving/loading, dynamic dimension handling, and device compatibility checks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
@github-actions
Copy link
Contributor

github-actions bot commented Dec 30, 2025

Documentation preview for 46690f9 is available at:

More info
  • Ignore this comment if this PR does not change the documentation.
  • The preview is updated when a new commit is pushed to this PR.
  • This comment was created by this workflow run.
  • The documentation was built by this workflow run.

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Copy link
Member

@BenWilson2 BenWilson2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few nits on error message text to make it a little more clear about why we don't support portability. Otherwise, LGTM for pt serde support!

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
@WeichenXu123 WeichenXu123 added this pull request to the merge queue Jan 15, 2026
Merged via the queue into mlflow:master with commit 81ef4b9 Jan 15, 2026
74 checks passed
@WeichenXu123 WeichenXu123 deleted the torch-safe-save branch January 15, 2026 14:06
harupy pushed a commit to harupy/mlflow that referenced this pull request Jan 28, 2026
…ort.save` (mlflow#19692)

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
harupy pushed a commit to harupy/mlflow that referenced this pull request Jan 28, 2026
…ort.save` (mlflow#19692)

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
harupy pushed a commit that referenced this pull request Jan 28, 2026
…ort.save` (#19692)

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
ridgupta26 pushed a commit to ridgupta26/mlflow-ridz that referenced this pull request Jan 29, 2026
…ort.save` (mlflow#19692)

Signed-off-by: Weichen Xu <weichen.xu@databricks.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/models MLmodel format, model serialization/deserialization, flavors rn/feature Mention under Features in Changelogs. v3.9.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants