Hironabe333/tf-savedmodel-concretefunction-capture-poc

TF SavedModel ConcreteFunction Variable Capture Differential — PoC

This repository contains a proof-of-concept demonstrating that a TF SavedModel can embed two distinct ConcreteFunction objects — each capturing a different set of tf.Variable values — such that the model produces different outputs depending on the dispatch path used.

Behavior

Call site	Output (input=[[1.0]])
loaded(x) — ObjectGraph __call__ dispatch	[[1.0]] (benign)
loaded.signatures['serving_default'](x=x) — SignatureDef dispatch	[[999.0]] (malicious)

Security scanners that evaluate models via model(x) observe only the benign output. TF Serving's default inference endpoint uses signatures['serving_default'].

Reproduction

pip install -r requirements.txt
python create_model.py
python reproduce.py

Requirements

tensorflow==2.10.1
numpy>=1.23.0,<2.0.0
protobuf>=3.9.2,<3.20.0
modelscan==0.8.8

Expected Output

model(x)             [Path A]  : [[1.0]]
signatures[s_d](x=x) [Path B]  : [[999.0]]
OUTPUT_FLIP_CONFIRMED           : True
ModelScan                       : No issues found!

Disclosure

This PoC was created for responsible disclosure purposes.