Model Versioning
Intermediate 14 min read Model Versioning

Artifact Serialization Formats

How the artifact travels shapes where it can run

The serialization format decides how a model travels, versioned and served: pickle is fragile and Python-bound, ONNX and others are portable. Format choice is a deployment decision made at training time.

pickleONNXmodel formatserializationportabilityruntime
Prerequisites: Why Version Models
Before we start

What you will learn

  • Compare pickle, joblib, ONNX and framework-native formats
  • Explain the security and portability costs of pickling
  • Choose a format by spanning serving runtime requirements
Introduction

What is this?

Artifact serialization is the byte format a trained model is saved in. It ranges from Python pickles (fragile, Python-bound, unsafe to load from untrusted sources) to portable interchange formats like ONNX that run across runtimes (PyTorch, TensorRT, ONNX Runtime). The format decides where the model can serve and how versionable it is.

Motivation

Why do you need it?

  • A model that only loads in the exact Python env that trained it is hard to serve, upgrade or move.
  • Pickle executes arbitrary code on load — a real supply-chain attack vector.
  • Portable formats let the best runtime, not the training laptop, run the model.
  • Version management is easier when formats encode version and signature robustly.
Think about it

Mental model

Imagine

Canned goods vs frozen prepared meals

Think of

Pickle vs portable formats

A canned soup (pickle) needs a can opener and is fragile, and you can't inspect it without opening it. A frozen meal kit (ONNX/portable) states ingredients, nutrition and heating time — anyone with an oven (any runtime) can cook it safely.

Mechanics

How it works

  • Framework-native saves preserve exact training semantics but tie you to the framework's runtime.
  • Pickle/joblib serialize the Python object graph — fast but executes code on load and resists cross-version load.
  • ONNX exports the computation graph to an open interchange schema with versioned opsets.
  • Runtimes (ONNX Runtime, TensorRT, OpenVINO) optimize and execute the portable graph.
  • The chosen format becomes part of the model's documented contract and serving requirements.

Format choice branches the serving runtime options.

Trained model
Native / pickle
ONNX / portable
Optimized runtimes
Serve anywhere
Hands-on

Examples

Export to a portable graph

Export to a portable graph
import torch, torch.onnx
model.eval()
dummy = torch.randn(1, 3, 224, 224)
torch.onnx.export(model, dummy, "model.onnx",
                  input_names=["image"], output_names=["logits"],
                  opset_version=18)

The exported ONNX graph carries inputs and opset version, so any ONNX runtime can execute it without the training framework. Verify with an import pass and equivalence check.

Real world

In production

  • A vision model ships as ONNX and runs on CPU OpenVINO for latency edge case and GPU TensorRT for throughput.
  • A tabular model stays as joblib because the sklearn pipeline (imputation) must travel with it — but only loads from the pinned image.
  • A platform standardizes on ONNX for anything that may serve outside the training cluster.
Guidelines

Best practices

  • Prefer portable interchange (ONNX) unless the framework's native operators are needed.
  • Never load pickled artifacts from untrusted sources.
  • Record format + opset/runtime version in the model's metadata.
  • Add a load-and-equivalence check (input → same output) to registry gates.
Watch out

Common mistakes

  • Pickling models with sklearn helpers that aren't importable in the serving image.
  • Cross-framework export that silently changes numerics — no equivalence test.
  • Assuming format = portable; some 'ONNX' is still framework-dependent behind tracing.
  • Loading a pickle from a URL or shared drive without provenance.
When things break

Debugging tips

  • Load fails in serving? Check runtime version vs the format's opset and pin them.
  • Small numeric diffs after export? Compare original vs exported on a fixed input batch.
  • Unpickle error mid-load? Missing module versions — pin the environment with the artifact.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

Which format is most suitable for serving across multiple runtimes?

2

Pickle files can execute arbitrary code when loaded.

Go deeper

Official documentation

ONNX overview and opsets
docs
ONNX Runtime docs
docs