celvexgroup/modelaudit-tflite-builtincode-differential-poc

PoC - modelaudit TFLite custom-op detection bypass (BuiltinCode field differential)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only (no custom kernel shipped).

• Scanner under test: modelaudit==0.2.49 with the modelaudit[tflite] extra (tflite bindings 2.18.0), Python 3.11.15.
• Format: TFLite (.tflite).
• Two-sided behavior: modelaudit scan bypass.tflite -> Clean / exit 0, but every conformant TFLite/LiteRT runtime resolves the op to CUSTOM (evil_marker_op). The control_*.tflite files are the SAME model with the fields set so modelaudit correctly fires CRITICAL S302 (exit 1) - proving the detector is live and bypass is a real miss.
• Root cause: modelaudit trusts the tflite binding's BuiltinCode(), which returns deprecated_builtin_code when builtin_code < 127; runtimes use max(builtin_code, deprecated_builtin_code). Setting builtin_code=CUSTOM(32), deprecated_builtin_code=ADD(0) makes modelaudit see ADD and the runtime see CUSTOM.

Files: bypass.tflite (scan Clean), control_new.tflite / benign_add.tflite (controls). Full report in the huntr submission.