You can deploy this model and start earning money today!

pragnyanramtha/
modelscan-savedmodel-dataset-io-bypass

Name: modelscan-savedmodel-dataset-io-bypass
Availability: InStock

tf-keras

Views

No views yet

Benign ModelScan SavedModel Dataset I/O Bypass PoC

This repository is a benign security proof-of-concept for Protect AI ModelScan. It demonstrates that ModelScan 0.8.8 flags direct TensorFlow ReadFile and WriteFile ops as high severity, but misses equivalent file read/write behavior when it is carried through TensorFlow Dataset ops inside a SavedModel.

Files

artifacts/savedmodel_dataset_io/ - primary PoC SavedModel.
artifacts/savedmodel_fixedlength_default_read_variant/ - read-only variant using FixedLengthRecordDatasetV2.
artifacts/savedmodel_savedataset_default_write_variant/ - write-only variant using SaveDataset.
controls/savedmodel_direct_file_io_control/ - direct ReadFile / WriteFile control that ModelScan flags.
verify_poc.py - end-to-end verifier for the primary PoC.
scripts/ - artifact generators, variant verifiers, and op extractor.
evidence/ - captured runtime, scanner, graph-op, and hash evidence.

Tested Versions

Python 3.12.3
TensorFlow 2.21.0
ModelScan 0.8.8

Reproduction

bash

python3 -m venv .venv
. .venv/bin/activate
python -m pip install --upgrade tensorflow modelscan
CUDA_VISIBLE_DEVICES=-1 python verify_poc.py
python -m modelscan.cli scan -p artifacts/savedmodel_dataset_io -r json --show-skipped
python -m modelscan.cli scan -p controls/savedmodel_direct_file_io_control -r json --show-skipped

Expected primary PoC behavior:

verify_poc.py reads TFSM_TEXTLINE_DATASET_MARKER_2026 through TextLineDataset.
verify_poc.py writes TFSM_DATASET_TO_TFRECORD_MARKER_2026 through DatasetToTFRecord.
ModelScan reports total_issues: 0 for artifacts/savedmodel_dataset_io.

Expected control behavior:

The direct control contains ReadFile and WriteFile.
ModelScan reports two high-severity issues for controls/savedmodel_direct_file_io_control.

Impact

This is not a TensorFlow vulnerability. TensorFlow SavedModels are executable graphs and file I/O behavior is expected when a graph contains filesystem ops.

The issue is a scanner false negative: ModelScan supports SavedModel scanning and already classifies direct file I/O ops as high severity, but it does not flag Dataset-based filesystem ops that can read controlled local files and write controlled local outputs during normal SavedModel execution.

Primary Artifact Hash

153485cab9a8aa350d4e47336ff6888ac073facfc554ac50d6fe77b7e7b71165 artifacts/savedmodel_dataset_io/saved_model.pb

Additional hashes are in evidence/final_sha256sums.txt.

Mitigation

ModelScan's SavedModel unsafe-op policy should include Dataset filesystem ops that can read or write host paths, including at least TextLineDataset, FixedLengthRecordDatasetV2, DatasetToTFRecord, and SaveDataset. Scanner tests should include direct ReadFile / WriteFile controls and dataset-backed equivalents.

pragnyanramtha/modelscan-savedmodel-dataset-io-bypass