You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

ONNX Runtime ConstantOfShape Constant-Folding Load DoS

Defensive validation / triage only. This repository contains a harmless reproduction artifact for bounded local load-time memory amplification.

A tiny crafted ONNX model can force ONNX Runtime's default L1 constant-folding pass to eagerly materialize a huge ConstantOfShape result during normal session creation. In current testing, an 85-byte model expands into roughly 582 MB peak RSS on onnxruntime 1.26.0 and 1.27.0 before any inference occurs.

Files

model/onnx-constantofshape-load-dos.onnx: crafted 85-byte artifact
model/small-control.onnx: 81-byte control artifact
generator/build_constantofshape_constant_folding_load_dos.py: deterministic internal builder
reproduce/replay_constantofshape_constant_folding_load_dos.py: isolated replay harness with JSON output
build-meta.json: pinned measurements and artifact metadata

Differential

Control: 81 bytes on disk, output shape [1024]
Crafted: 85 bytes on disk, output shape [134217728]
Observed on Ubuntu 24.04 x86_64:
- onnxruntime 1.26.0: crafted default load peaks around 581 MB RSS
- onnxruntime 1.27.0: crafted default load peaks around 582 MB RSS
- onnxruntime 1.27.0 with ORT_DISABLE_ALL: same artifact stays around 57 MB RSS

Quick Repro

/home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-constantofshape-constant-folding-load-dos/reproduce/replay_constantofshape_constant_folding_load_dos.py \
  --crafted-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-constantofshape-constant-folding-load-dos/model/onnx-constantofshape-load-dos.onnx \
  --control-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-constantofshape-constant-folding-load-dos/model/small-control.onnx \
  --python-bin /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  --mode default \
  --repeats 1

Notes

Harmless proof only: the effect is bounded local memory pressure and slower model load.
No victim source modifications are required.
The root cause is default optimizer behavior, not sparse tensor densification.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support