Kanisia/onnx-triggered-loop-dos-modelscan-bypass

ONNX Triggered Loop Compute DoS ModelScan Bypass

Target

ONNX model format.

Summary

onnx_triggered_loop_dos.onnx is a 755-byte ONNX model that passes ONNX validation, passes ONNX shape inference, and loads successfully in ONNX Runtime.

The model behaves normally for ordinary input, returning [0.0] immediately. When the trigger input 13.37 is supplied, the graph enters an If branch containing a Loop with trip count 100000000, causing compute-time denial of service. The local verification run times out during triggered inference.

ModelScan does not scan ONNX files and reports SCAN_NOT_SUPPORTED with no issues.

Files

• onnx_triggered_loop_dos.onnx: PoC model file to upload to Hugging Face.
• build_and_verify.py: Builds the model and verifies validation, normal inference, triggered inference, and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-onnx-triggered-loop-dos\build_and_verify.py

Expected result:

• model size is 755 bytes.
• onnx.load_model succeeds.
• onnx.checker.check_model succeeds.
• onnx.shape_inference.infer_shapes_path succeeds.
• onnxruntime.InferenceSession load succeeds.
• normal inference with input [1.0] returns [0.0].
• triggered inference with input [13.37] times out.
• ModelScan reports no issues and skips the ONNX file as SCAN_NOT_SUPPORTED.

Impact

An attacker can publish a small ONNX model that appears benign during casual testing but causes compute exhaustion only for a hidden trigger input. Automated systems that rely on ModelScan receive no warning because the ONNX file is not inspected.