hacnho/tensorrt-groupnorm-serialized-state-bypass-poc

TensorRT GroupNormalizationPlugin Serialized State Bypass PoC

This repository contains a minimal TensorRT MFV proof of concept for silent inference output manipulation through the GroupNormalizationPlugin serialized plugin state.

Files:

• control_groupnorm.engine - TensorRT engine built with eps=1e-5, num_groups=2.
• malicious_eps_huge_groupnorm.engine - same engine with the serialized mEpsilon field patched to 1000000.0.
• malicious_groups_one_groupnorm.engine - same engine with serialized mNbGroups patched from 2 to 1.
• verify_groupnorm.py - loads each engine, runs the same input, and compares output signatures.
• gpu0-evidence.json / gpu1-evidence.json - reproduction evidence from two RTX 4090 GPUs.

Expected result:

• all three engines deserialize successfully;
• all three engines execute successfully;
• all three outputs keep the same TensorRT output shape;
• both malicious engines return different normalized activations from the control engine.

Example:

python3 -m venv .venv
. .venv/bin/activate
python -m pip install tensorrt==11.1.0.106 nvidia-cudnn-cu12==8.9.7.29
export LD_LIBRARY_PATH="$VIRTUAL_ENV/lib/python3.12/site-packages/nvidia/cudnn/lib:$LD_LIBRARY_PATH"
python verify_groupnorm.py --gpu 0 --strict

On the reporter's RTX 4090 lab, the control output begins:

[-1.527524, -1.091089, -0.654653, -0.218218, 0.218218, 0.654653]

The eps=1000000.0 malicious output begins:

[-0.0035, -0.0025, -0.0015, -0.0005, 0.0005, 0.0015]

The num_groups=1 malicious output begins:

[-1.626978, -1.410048, -1.193117, -0.976187, -0.759256, -0.542326]