hacnho/tensorrt-pillarscatter-dense-shape-bypass-poc

TensorRT PillarScatterPlugin dense_shape bypass proof of concept

This repository contains a bounded research PoC for TensorRT (.engine / .trt / .mytrtfile).

The security question is whether a serialized PillarScatterPlugin payload can bypass the creator-side dense_shape > 0 checks and rewrite the final runtime-visible output feature-map shape of a built .engine file.

Files

• control.engine
• feature-y-zero.engine
• feature-y-huge.engine
• verify_remote_poc.py

What the files demonstrate

Control case:

runtime-visible output shape -> [1, 3, 4, 4]

Mutated serialized cases:

feature_y_size = 0      -> [1, 3, 0, 4]
feature_y_size = 65536  -> [1, 3, 65536, 4]

The creator path validates dense_shape > 0, but the serialized/deserializer path restores feature_y_size_ and feature_x_size_ directly and uses those values in getOutputDimensions(...).

Verify the public HF artifacts

After unauthenticated download, run:

python verify_remote_poc.py

Expected result:

• all .engine files still deserialize successfully
• the control output shape stays [1, 3, 4, 4]
• the mutated output shapes differ from the control
• shape_bypass_observed is true

Public scan note

After upload, check:

https://huggingface.co/api/models/hacnho/tensorrt-pillarscatter-dense-shape-bypass-poc/scan

This PoC is centered on trusted load/build/runtime-visible shape manipulation, not on code execution.

Safety note

This is a bounded research PoC:

• no code execution claim
• no external callbacks
• only deterministic output-shape rewriting carried by serialized plugin state