OpenVINO MulticlassNMS allocation DoS PoC

This repository contains two valid OpenVINO IR XML/BIN model pairs that differ only in the MulticlassNMS input shape embedded in the model file.

Observed behavior with openvino==2026.2.1 under a 3 GiB address-space cap:

control model:
- read_model() succeeds
- compile_model() succeeds
- inference succeeds with 3 normal MulticlassNMS outputs
malicious model:
- read_model() succeeds
- compile_model() raises RuntimeError: std::bad_alloc

Public repo:

Repo: https://huggingface.co/hacnho/openvino-multiclass-nms-allocation-dos-poc
Control XML: https://huggingface.co/hacnho/openvino-multiclass-nms-allocation-dos-poc/resolve/main/control_multiclass_nms_2.xml
Control BIN: https://huggingface.co/hacnho/openvino-multiclass-nms-allocation-dos-poc/resolve/main/control_multiclass_nms_2.bin
Malicious XML: https://huggingface.co/hacnho/openvino-multiclass-nms-allocation-dos-poc/resolve/main/malicious_multiclass_nms_300m.xml
Malicious BIN: https://huggingface.co/hacnho/openvino-multiclass-nms-allocation-dos-poc/resolve/main/malicious_multiclass_nms_300m.bin
Reproducer: https://huggingface.co/hacnho/openvino-multiclass-nms-allocation-dos-poc/resolve/main/reproduce.py
Repo state at verification time: private=false, commit 1ffcbdc67069409401b4baa05e4c67a007b5f973

Reproduction:

python3 build_poc.py
python3 reproduce.py

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support