hacnho/tensorflowjs-unused-optimizer-weightspecs-poc

TensorFlow.js optimizer weightSpecs amplification PoC

This repository contains a benign security research proof of concept for a TensorFlow.js model.json that appends a very large number of zero-length optimizer weight specs.

Files

• model.json - TF.js layers-model file with extra optimizer-group weight specs
• weights.bin - tiny 8-byte control weights buffer
• build-meta.json - entry count and artifact sizes
• package.json - minimal dependency on @tensorflow/tfjs 4.22.0
• reproduce_from_files.js - local replay helper

What it demonstrates

loadLayersModel() decodes the full weightSpecs list before deciding whether optimizer weights are relevant.

With 1000000 zero-length optimizer specs:

• model.json is about 68.56 MB
• local replay drives about 1.3 GB RSS
• the model still loads successfully

Quick repro

npm ci
node --expose-gc reproduce_from_files.js .

Expected output shape:

{
  "entries": 1000000,
  "json_mb": 68.56,
  "ms": 2876,
  "rss_before": 554.7,
  "rss_after": 1313.7,
  "pred": [[1.975830834697992e-43]]
}

This PoC is intended for defensive validation and bug bounty triage only.