OSOR-SDXL-Inpainting (phase II) — safetensors mirror

A byte-for-byte safetensors conversion of the OSOR-SDXL-Inpainting phase-II checkpoint released by the OSOR authors, plus the fixed-prompt text embeddings the generator conditions on. Hosted so that sayvoy-look can pull it through a pickle-free, digest-pinned path. Nothing about the weights was changed.

Field	Value
Paper	OSOR: One-Step Diffusion Inpainting for Effect-Aware Object Removal — Qinming Zhou, Chenxi Sun, Deyang Kong, Junhao He, Xiangheng Tang, Peike Yu, Haotian Wu, Leilei Cao, Linfeng Zhang. ECCV 2026.
Upstream weights	QinmingZhou/OSOR, file osor-sdxlinpainting/weights/sdxlinpainting_phase2.pth
Upstream code	https://github.com/Zhouqm-Git/osor (MIT)
Base model	diffusers/stable-diffusion-xl-1.0-inpainting-0.1
License	CreativeML Open RAIL++-M — see LICENSE.md. Upstream states: "OSOR-SDXL-Inpainting is subject to the CreativeML Open RAIL++-M License, including its use-based restrictions."

Files

File	Bytes	SHA-256
sdxlinpainting_phase2.safetensors	3,111,950,972	fff6bea76360666f1233dbf74840f45a438140f2c0f093365ef017ebd7a457ff
fixed_prompt_embeds.safetensors	636,136	93bc3ef2fe9e1616c164450aa58f9f34ba23569215722158d83a3fb5ad157e50

sdxlinpainting_phase2.safetensors holds the phase-II state dict: the rank-256 LoRA over the SDXL-Inpainting UNet and the widened 5-channel conv_out (the fifth channel is the predicted removal alpha). Wrapper prefixes left by DDP / torch.compile (module., _orig_mod.) were stripped so the keys load into the generator directly.

fixed_prompt_embeds.safetensors is derived data, not an upstream file: the model's single fixed prompt ("Remove the instance of object") encoded once by the two CLIP text encoders of SDXL-Inpainting 0.1, exactly as the authors' cache_prompts.py does, stored so the generator runs without loading the text encoders. Tensors: prompt_embeds and pooled_prompt_embeds.

What "conversion" means here

The released checkpoint is a PyTorch zip whose payload is a pickle — a code-execution vector on load. The conversion procedure, run once on 2026-09-14:

1. The pickle was scanned statically with pickletools (nothing executed); the only globals it names are collections.OrderedDict, torch.FloatStorage/HalfStorage and torch._utils._rebuild_tensor_v2 — a plain dict of tensors.
2. It was loaded once under PyTorch's restricted unpickler and written out as safetensors.
3. The safetensors file was read back and compared bit for bit against the loaded tensors.
4. The SHA-256 above was pinned; a consumer verifies it before use.

The generator code is not part of this repo. sayvoy-look ports the ~40 lines that matter (LoRA configuration and the widened conv_out) rather than vendoring the OSOR repository.

License and attribution

The weights are redistributed under the same CreativeML Open RAIL++-M license as upstream, whose text — including the use-based restrictions in Attachment A — is in LICENSE.md. Outputs of the model are not restricted by the license. Credit for the model belongs to the OSOR authors; please cite the paper. The FLUX-Fill variants of OSOR (FLUX.1 [dev] Non-Commercial) are not mirrored here.

@inproceedings{zhou2026osor,
  title     = {OSOR: One-Step Diffusion Inpainting for Effect-Aware Object Removal},
  author    = {Zhou, Qinming and Sun, Chenxi and Kong, Deyang and He, Junhao and Tang, Xiangheng and Yu, Peike and Wu, Haotian and Cao, Leilei and Zhang, Linfeng},
  booktitle = {European Conference on Computer Vision (ECCV)},
  year      = {2026}
}