surrealgrain/modelscan-savedmodel-pbtxt-bypass-poc

ModelScan SavedModel pbtxt Scanner Bypass PoC

This repository contains a harmless TensorFlow SavedModel proof of concept for a ModelScan coverage bypass.

TensorFlow's SavedModel loader accepts either saved_model.pb or saved_model.pbtxt. ModelScan's default TensorFlow scanner maps only the .pb suffix to the TensorFlow SavedModel scanner, so a model whose graph is stored as saved_model.pbtxt is skipped even when it contains the same unsafe ReadFile and WriteFile operators that ModelScan detects in the binary .pb control.

Contents

• poc_model/: valid TensorFlow SavedModel using saved_model.pbtxt.
• reproduce.py: script used to create and invoke the binary and pbtxt variants.
• modelscan-pb-control.txt: ModelScan output for the binary saved_model.pb control. It reports HIGH ReadFile and WriteFile issues.
• modelscan-pbtxt-bypass.txt: ModelScan default output for the saved_model.pbtxt variant. It exits cleanly with no issues.
• modelscan-pbtxt-show-skipped.txt: ModelScan output showing saved_model.pbtxt was skipped.
• sha256.txt: hashes of the regenerated verification artifacts.

Reproduction

python3.12 -m venv .venv
. .venv/bin/activate
pip install tensorflow modelscan

python reproduce.py invoke --model-dir poc_model --marker /tmp/savedmodel-pbtxt-copy.txt
cat /tmp/savedmodel-pbtxt-copy.txt

modelscan -p poc_model
modelscan -p poc_model --show-skipped

Expected behavior:

• TensorFlow loads poc_model and invoking the exported serving_default signature reads a caller-supplied source file and writes/copies it to /tmp/savedmodel-pbtxt-copy.txt.
• modelscan -p poc_model reports no issues and exits 0.
• modelscan -p poc_model --show-skipped shows poc_model/saved_model.pbtxt was skipped.

For comparison, regenerating the binary control with reproduce.py make produces an equivalent saved_model.pb model that ModelScan detects as HIGH due to the ReadFile and WriteFile operators.