Kanisia/onnx-loop-compute-dos-modelscan-bypass

ONNX Loop Compute DoS ModelScan Bypass

Target

ONNX model format.

Summary

onnx_loop_compute_dos.onnx is a 342-byte ONNX model with no inputs. It passes ONNX validation, passes ONNX shape inference, and loads successfully in ONNX Runtime.

When inference is executed, the graph uses the ONNX Loop operator with a constant trip count of 100000000. The loop body only performs Identity and Add, but the huge iteration count causes compute-time denial of service. The local verification run times out during inference.

ModelScan does not scan ONNX files and reports SCAN_NOT_SUPPORTED with no issues.

Files

• onnx_loop_compute_dos.onnx: PoC model file to upload to Hugging Face.
• build_and_verify.py: Builds the model and verifies load, validation, shape inference, runtime behavior, and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-onnx-loop-compute-dos\build_and_verify.py

Expected result:

• model size is 342 bytes.
• onnx.load_model succeeds.
• onnx.checker.check_model succeeds.
• onnx.shape_inference.infer_shapes_path succeeds.
• onnxruntime.InferenceSession load succeeds.
• inference times out because Loop executes an extremely high number of iterations.
• ModelScan reports no issues and skips the ONNX file as SCAN_NOT_SUPPORTED.

Impact

An attacker can publish a tiny ONNX model that passes validation and loads normally, but causes compute exhaustion during inference without requiring any input. Automated systems that rely on ModelScan receive no warning because the ONNX file is not inspected.