---
tags:
  - security
  - proof-of-concept
  - coreml
license: mit
---

# Core ML function input materialization DoS PoC

This repository contains a benign security research PoC for a `.mlmodel`
artifact that drives large protobuf materialization during Core ML spec loading.

Files:

- `control_same_size.mlmodel`
- `malicious_function_input_1000000.mlmodel`
- `reproduce.py`

Observed behavior:

- control artifact:
  - parses successfully with one function and zero nested input entries
- malicious artifact:
  - same size as control
  - parses successfully with one function and `1,000,000` nested input entries
  - `load_spec()` peak RSS delta is about `119072 kB`
  - `MLModel(skip_model_load=True)` peak RSS delta is about `310288 kB`

Public files:

- `https://huggingface.co/hacnho/coreml-function-input-fanout-dos-poc/resolve/main/control_same_size.mlmodel`
- `https://huggingface.co/hacnho/coreml-function-input-fanout-dos-poc/resolve/main/malicious_function_input_1000000.mlmodel`
- `https://huggingface.co/hacnho/coreml-function-input-fanout-dos-poc/resolve/main/reproduce.py`

Reproduction:

```bash
python3 build_poc.py
python3 reproduce.py
```