thesecguy/poc-tf-savedmodel-modelscan-bypass

Defensive PoC: TF SavedModel SaveV2 ACE-equivalent at load + ProtectAI modelscan bypass

Do not load in production. The model writes sentinel files /tmp/PWN_TFSM_SAVEV2.* during tf.saved_model.load() via a SaveV2 raw op planted in the __saved_model_init_op function body.

What it shows

modelscan 0.8.8 only flags ReadFile / WriteFile ops in .pb SavedModels. SaveV2 (and many other side-effecting raw ops: SaveSlices, WriteSummary, MatchingFiles, CreateSummaryFileWriter, ...) are NOT in the blocklist.

tf.saved_model.load() runs StatefulPartitionedCall_1 -> the function in graph_def.library.function referenced by the init op -- including any node listed in function.control_ret.

Reproduce

pip install tensorflow modelscan
tar -xzf out_pb_savev2.tar.gz -C ./model
modelscan -p ./model
# No issues found!
python3 -c "import tensorflow as tf; tf.saved_model.load('./model')"
ls /tmp/PWN_TFSM_SAVEV2.*

Disclosed via huntr.com.