| | --- |
| | license: mit |
| | language: en |
| | tags: |
| | - security |
| | - vulnerability-research |
| | - model-security |
| | - poc |
| | - multi-format |
| | --- |
| | |
| | # Multi-Format Model Vulnerability & Scanner Bypass Suite |
| |
|
| | This repository contains a suite of Proof-of-Concept (PoC) model files demonstrating critical security vulnerabilities in modern AI model serialization formats. This research focuses on **Load-Time Arbitrary Code Execution (ACE)** and **Scanner Evasion** techniques. |
| |
|
| | ## 🚀 Research Highlights |
| |
|
| | - **Scanner Bypass (Safetensors/ZIP Polyglot):** A novel technique that crafts a file valid as both Safetensors and ZIP, allowing malicious payloads to evade automated security scanners (e.g., ModelScan). |
| | - **Multi-Format Coverage:** Demonstrates exploits in `.safetensors`, `.gguf`, `.keras`, and `.joblib`. |
| | - **Memory Corruption:** Integer overflow and OOB read vulnerabilities in GGUF metadata parsing. |
| | - **ACE via Deserialization:** Direct command execution during model loading in Joblib and Keras 3. |
| |
|
| | ## 📂 Repository Structure |
| |
|
| | - `submission_poc.py`: Master reproduction script used to generate all artifacts. |
| | - `poc_output/`: Contains the generated malicious model files and the detailed technical report. |
| | - `vulnerability_report.md`: Comprehensive technical analysis, CVSS scoring, and reproduction steps. |
| | - `polyglot_bypass.safetensors`: The scanner bypass PoC. |
| | - `gguf_overflow.gguf`: Memory corruption PoC. |
| | - `module_injection.keras`: Keras 3 ACE PoC. |
| | - `malicious.joblib`: Joblib/Pickle ACE PoC. |
| |
|
| | ## ⚠️ Disclaimer |
| |
|
| | This repository is for **educational and authorized security research purposes only**. The PoCs demonstrate how malicious model files can compromise systems at load time. Always use `safe_mode=True` and avoid loading untrusted model files. |
| |
|
| | ## 🔗 Submission Details |
| |
|
| | This research is part of the **Protect AI / Huntr** bounty program for Model File Vulnerabilities (MFV). |
| |
|
