OSOR-SDXL-Inpainting (phase II) — safetensors mirror
A byte-for-byte safetensors conversion of the OSOR-SDXL-Inpainting phase-II checkpoint released by the OSOR authors, plus the fixed-prompt text embeddings the generator conditions on. Hosted so that sayvoy-look can pull it through a pickle-free, digest-pinned path. Nothing about the weights was changed.
| Field | Value |
|---|---|
| Paper | OSOR: One-Step Diffusion Inpainting for Effect-Aware Object Removal — Qinming Zhou, Chenxi Sun, Deyang Kong, Junhao He, Xiangheng Tang, Peike Yu, Haotian Wu, Leilei Cao, Linfeng Zhang. ECCV 2026. |
| Upstream weights | QinmingZhou/OSOR, file osor-sdxlinpainting/weights/sdxlinpainting_phase2.pth |
| Upstream code | https://github.com/Zhouqm-Git/osor (MIT) |
| Base model | diffusers/stable-diffusion-xl-1.0-inpainting-0.1 |
| License | CreativeML Open RAIL++-M — see LICENSE.md. Upstream states: "OSOR-SDXL-Inpainting is subject to the CreativeML Open RAIL++-M License, including its use-based restrictions." |
Files
| File | Bytes | SHA-256 |
|---|---|---|
sdxlinpainting_phase2.safetensors | 3,111,950,972 | fff6bea76360666f1233dbf74840f45a438140f2c0f093365ef017ebd7a457ff |
fixed_prompt_embeds.safetensors | 636,136 | 93bc3ef2fe9e1616c164450aa58f9f34ba23569215722158d83a3fb5ad157e50 |
sdxlinpainting_phase2.safetensors holds the phase-II state dict: the rank-256 LoRA
over the SDXL-Inpainting UNet and the widened 5-channel conv_out (the fifth channel
is the predicted removal alpha). Wrapper prefixes left by DDP / torch.compile
(module., _orig_mod.) were stripped so the keys load into the generator directly.
fixed_prompt_embeds.safetensors is derived data, not an upstream file: the
model's single fixed prompt ("Remove the instance of object") encoded once by the
two CLIP text encoders of SDXL-Inpainting 0.1, exactly as the authors'
cache_prompts.py does, stored so the generator runs without loading the text encoders.
Tensors: prompt_embeds and pooled_prompt_embeds.
What "conversion" means here
The released checkpoint is a PyTorch zip whose payload is a pickle — a code-execution vector on load. The conversion procedure, run once on 2026-09-14:
- The pickle was scanned statically with
pickletools(nothing executed); the only globals it names arecollections.OrderedDict,torch.FloatStorage/HalfStorageandtorch._utils._rebuild_tensor_v2— a plain dict of tensors. - It was loaded once under PyTorch's restricted unpickler and written out as safetensors.
- The safetensors file was read back and compared bit for bit against the loaded tensors.
- The SHA-256 above was pinned; a consumer verifies it before use.
The generator code is not part of this repo. sayvoy-look ports the ~40 lines that
matter (LoRA configuration and the widened conv_out) rather than vendoring the
OSOR repository.
License and attribution
The weights are redistributed under the same CreativeML Open RAIL++-M license as
upstream, whose text — including the use-based restrictions in Attachment A — is in
LICENSE.md. Outputs of the model are not restricted by the license.
Credit for the model belongs to the OSOR authors; please cite the paper. The FLUX-Fill
variants of OSOR (FLUX.1 [dev] Non-Commercial) are not mirrored here.
@inproceedings{zhou2026osor,
title = {OSOR: One-Step Diffusion Inpainting for Effect-Aware Object Removal},
author = {Zhou, Qinming and Sun, Chenxi and Kong, Deyang and He, Junhao and Tang, Xiangheng and Yu, Peike and Wu, Haotian and Cao, Leilei and Zhang, Linfeng},
booktitle = {European Conference on Computer Vision (ECCV)},
year = {2026}
}