willardj/modelscan-tf-savedmodel-bypass-poc

ModelScan TF SavedModel Scanner Bypass PoC

Finding: MFV-VULN-05

ModelScan's SavedModelTensorflowOpScan only blocks 2 TensorFlow ops: ReadFile and WriteFile. TensorFlow has 1,471 raw ops, 96 of which are file-related. This PoC demonstrates filesystem access via unblocked ops that ModelScan does not detect.

Proof

The trojan-classifier/ directory contains a TF SavedModel that:

1. Appears normal: predict() function performs standard image classification (784→10 dense layer)
2. Hidden payload: preprocess() function uses MatchingFiles op to enumerate the filesystem

Ops in the model (from saved_model.pb):

• MatchingFiles — filesystem glob — NOT in ModelScan blocklist
• StringFormat — data formatting — NOT in ModelScan blocklist
• Standard ops: MatMul, Softmax, AddV2 (legitimate ML operations)

ModelScan result: CLEAN (no detections)

Reproduction

pip install tensorflow
python3 huntr-tf-savedmodel-poc-v2.py build    # Creates trojan model
python3 huntr-tf-savedmodel-poc-v2.py verify   # Demonstrates filesystem enumeration  
python3 huntr-tf-savedmodel-poc-v2.py scan-check  # Shows ModelScan misses the payload

Environment

• TensorFlow 2.20.0
• Python 3.13