You can deploy this model and start earning money today!

xandramax/
modelscan-savedmodel-bypass-poc

Name: modelscan-savedmodel-bypass-poc
Availability: InStock

Views

No views yet

ModelScan SavedModel TF Op Blocklist Bypass PoC

Proof-of-concept demonstrating that modelscan v0.8.8's SavedModelTensorflowOpScan blocks only ReadFile and WriteFile, while PrintV2 (which can write arbitrary content to arbitrary files via file:// URI in its output_stream parameter) passes undetected.

TensorFlow's own saved_model_cli already blocks PrintV2 in its _OP_DENYLIST alongside ReadFile and WriteFile.

Requirements

Python 3.11+
TensorFlow 2.x
modelscan 0.8.8 (commit 61fcec9)

Usage

bash

pip install tensorflow
git clone https://github.com/protectai/modelscan /tmp/modelscan
cd /tmp/modelscan && git checkout 61fcec9

python3 poc-savedmodel-modelscan-bypass.py

What It Does

Enumerates dangerous TF ops that pass modelscan's blocklist
Builds a SavedModel with PrintV2(output_stream="file:///tmp/...") payload
Scans with modelscan -- confirms 0 issues (false negative)
Loads and calls the model -- confirms arbitrary file write executes

Tested On

macOS (Apple Silicon)
TensorFlow 2.21.0
modelscan v0.8.8 (commit 61fcec9, clean checkout)

xandramax/modelscan-savedmodel-bypass-poc