You need to agree to share your Hugging Face information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

This repository contains a deliberately malicious TensorFlow SavedModel published for authorized security research / coordinated disclosure (huntr / ProtectAI). Access is gated and manually reviewed. Do not run or serve this model on any system you care about.

⚠️ Security PoC — malicious TensorFlow SavedModel (ModelScan bypass → ACE)

Deliberately malicious TensorFlow SavedModel (.pb) for coordinated vulnerability disclosure.

What it demonstrates

ModelScan's TensorFlow SavedModel scanner (SavedModelTensorflowOpScan) treats only the two literal ops ReadFile and WriteFile as unsafe. Every other legitimate TensorFlow op is whitelisted:

if op in unsafe_operators:          # {"ReadFile","WriteFile"} -> HIGH
    ...
elif op not in all_safe_operators:  # unknown/custom op        -> MEDIUM
    ...
else:                               # any other real TF op
    continue                        # -> treated as SAFE

The PrintV2 op accepts output_stream="file://<path>", giving an arbitrary file write of attacker-controlled bytes to an attacker-controlled path. Because the op is named PrintV2 (not WriteFile), ModelScan reports the model as clean — yet running/serving it writes the file, which escalates to code execution (append to ~/.bashrc, /etc/cron.d/*, ~/.ssh/authorized_keys).

Target format

TensorFlow SavedModel — saved_model.pb (protobuf GraphDef) inside the SavedModel directory. The malicious op lives in the graph's function library.

Files

malicious_savedmodel/ — looks like a benign x -> 2x model; hides a PrintV2 file-write sink
control_savedmodel/ — same file write via WriteFile (ModelScan flags HIGH)
build_tf_poc.py — generator
verify_savedmodel.py / trigger_savedmodel.py — scan + execute helpers

Reproduce

pip install tensorflow==2.21.0 'modelscan[tensorflow]'

# 1) BYPASS — scanner sees nothing on the malicious model
modelscan -p malicious_savedmodel/        # -> No issues found 🎉

# 2) CONTROL — same write via WriteFile, correctly flagged
modelscan -p control_savedmodel/          # -> HIGH (Unsafe operator WriteFile)

# 3) Run the "clean" model like normal inference -> arbitrary file write -> RCE
python trigger_savedmodel.py malicious_savedmodel

Evidence

1. ModelScan bypass — PrintV2 file-write model is clean; WriteFile control is HIGH:

2. File write → code execution — the benign-looking model writes an attacker file on inference; sourcing it executes code:

Remediation

ModelScan should not rely on a two-name allowlist. It should flag the full set of filesystem/network/IO-capable TF ops (PrintV2 with a file:///http:// stream, Save, SaveV2, MergeV2Checkpoints, MatchingFiles, dataset/IO readers, etc.), and inspect dangerous op attributes (e.g. PrintV2.output_stream).

Downloads last month: -

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support