YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
CoreML .mlpackage weight.bin content-only swap PoC
Summary
CoreML .mlpackage (mlprogram type) stores model weights in a separate binary file (Data/com.apple.CoreML/weights/weight.bin), independent of the model specification (model.mlmodel). This separation means that weight.bin can be replaced with the weights of a different model while model.mlmodel remains byte-identical.
Key finding: ct.models.MLModel.get_spec() reads only model.mlmodel (the protobuf spec). It does not read or validate weight.bin content. The Manifest.json does not contain a content hash of weight.bin. As a result, weight.bin substitution is invisible to Python-level inspection but changes runtime inference output.
T0 Result
| Item | Value |
|---|---|
model.mlmodel SHA256 (baseline) |
21b942125388ef8b... |
model.mlmodel SHA256 (mutant) |
21b942125388ef8b... (identical) |
get_spec() spec identical |
True |
predict() baseline output |
[1. 2. 3. 4.] |
predict() mutant output |
[10. 20. 30. 40.] |
| OUTPUT_CHANGED | True |
| SPEC_UNCHANGED | True |
Requirements
- macOS (arm64 or x86_64)
- Python 3.11
pip install coremltools
How to Run
pip install coremltools
python3.11 reproduce.py
Root
ct.models.MLModel.get_spec() returns the protobuf spec from model.mlmodel only. Weight values for mlprogram type are stored in weight.bin and are not reflected in the spec. The Manifest.json package manifest does not include a content integrity hash for weight.bin. Substituting weight.bin with weights from a different model is therefore not detectable at the Python inspection layer, but changes inference output.