hacnho/tensorrt-gridanchor-maxsize-bypass-poc

TensorRT GridAnchor_TRT serialized maxSize MFV PoC

This repository is a benign security research PoC for Huntr MFV triage. It demonstrates a TensorRT .engine file where serialized GridAnchor_TRT plugin state changes the layer-1 anchor generator maxSize from 0.95 to 0.25. The engine still deserializes and executes, but layer-1 anchor coordinates change while output tensor shapes stay [1, 2, 48, 1] and [1, 2, 64, 1].

Files:

• control_gridanchor.engine: TensorRT 11.1.0.106 control engine with serialized GridAnchor_TRT layer-1 maxSize=0.95.
• malicious_maxsize_025.engine: same engine with serialized layer-1 maxSize patched from 0.95 to 0.25.
• reproduce.py: runs both engines and compares output shapes, execution status, and anchor coordinates.
• probe.py: builds the control engine and documents the serialized-field mutation.
• requirements.txt: tested dependency versions.

Public files:

• Repo: https://huggingface.co/hacnho/tensorrt-gridanchor-maxsize-bypass-poc
• Control: https://huggingface.co/hacnho/tensorrt-gridanchor-maxsize-bypass-poc/resolve/main/control_gridanchor.engine
• Malicious: https://huggingface.co/hacnho/tensorrt-gridanchor-maxsize-bypass-poc/resolve/main/malicious_maxsize_025.engine
• Reproducer: https://huggingface.co/hacnho/tensorrt-gridanchor-maxsize-bypass-poc/resolve/main/reproduce.py

Reproduction:

python reproduce.py \
  --control control_gridanchor.engine \
  --malicious malicious_maxsize_025.engine
modelscan -p malicious_maxsize_025.engine --show-skipped

Expected result:

• TensorRT deserializes and executes both engines.
• Output shapes remain [1, 2, 48, 1] and [1, 2, 64, 1].
• anchors0 remains unchanged.
• anchors1 first box changes from [-0.225, -0.225, 0.725, 0.725] to [0.125, 0.125, 0.375, 0.375].
• modelscan 0.8.8 reports No issues found! and skips the .engine file.

Tested SHA256:

• control_gridanchor.engine: a155c653dd0bf899253d7f7de2634400b7f9ce85dda4b64b3f32c47f0706ad14
• malicious_maxsize_025.engine: 59f5448f73c6c3a419f41c7eef3746e0a7896bef174e8ee303bb076c3ef3fcc1