xandramax/modelscan-savedmodel-bypass-poc

ModelScan SavedModel TF Op Blocklist Bypass PoC

Proof-of-concept demonstrating that modelscan v0.8.8's SavedModelTensorflowOpScan blocks only ReadFile and WriteFile, while PrintV2 (which can write arbitrary content to arbitrary files via file:// URI in its output_stream parameter) passes undetected.

TensorFlow's own saved_model_cli already blocks PrintV2 in its _OP_DENYLIST alongside ReadFile and WriteFile.

Requirements

• Python 3.11+
• TensorFlow 2.x
• modelscan 0.8.8 (commit 61fcec9)

Usage

pip install tensorflow
git clone https://github.com/protectai/modelscan /tmp/modelscan
cd /tmp/modelscan && git checkout 61fcec9

python3 poc-savedmodel-modelscan-bypass.py

What It Does

1. Enumerates dangerous TF ops that pass modelscan's blocklist
2. Builds a SavedModel with PrintV2(output_stream="file:///tmp/...") payload
3. Scans with modelscan -- confirms 0 issues (false negative)
4. Loads and calls the model -- confirms arbitrary file write executes

Tested On

• macOS (Apple Silicon)
• TensorFlow 2.21.0
• modelscan v0.8.8 (commit 61fcec9, clean checkout)