hacnho/openvino-tile-repeat-allocation-dos-poc

OpenVINO Tile repeat allocation DoS PoC

This repository contains two valid OpenVINO IR XML/BIN model pairs that differ only in the Tile repeat count embedded in the model file.

Observed behavior with openvino==2026.2.1 under a 2 GiB address-space cap:

• control model:
  • read_model() succeeds
  • compile_model() succeeds
  • inference succeeds with output shape [1, 2]
• malicious model:
  • read_model() succeeds
  • compile_model() succeeds
  • inference raises RuntimeError: can't alloc

Files:

• control_tile_repeat_2.xml / .bin
• malicious_tile_repeat_300m.xml / .bin
• reproduce.py

Public repo:

• Repo: https://huggingface.co/hacnho/openvino-tile-repeat-allocation-dos-poc
• Control XML: https://huggingface.co/hacnho/openvino-tile-repeat-allocation-dos-poc/resolve/main/control_tile_repeat_2.xml
• Control BIN: https://huggingface.co/hacnho/openvino-tile-repeat-allocation-dos-poc/resolve/main/control_tile_repeat_2.bin
• Malicious XML: https://huggingface.co/hacnho/openvino-tile-repeat-allocation-dos-poc/resolve/main/malicious_tile_repeat_300m.xml
• Malicious BIN: https://huggingface.co/hacnho/openvino-tile-repeat-allocation-dos-poc/resolve/main/malicious_tile_repeat_300m.bin
• Reproducer: https://huggingface.co/hacnho/openvino-tile-repeat-allocation-dos-poc/resolve/main/reproduce.py
• Repo state at verification time: private=false, commit c7690163768b6b8a2c0880b29b4d7fca0fbd3a5d

Reproduction:

python3 build_poc.py
python3 reproduce.py