hacnho/tensorrt-roialign-mode-bypass-poc

TensorRT ROIAlign_TRT mode-field output manipulation PoC

This repository contains a benign MFV proof-of-concept for a TensorRT .engine artifact where a serialized ROIAlign_TRT plugin state field changes normal inference output while modelscan==0.8.8 reports no issues and skips the engine file.

Files:

• control_roialign_avg.engine: control engine with serialized ROIAlign_TRT.mode = 1 (average pooling).
• malicious_roialign_max.engine: patched engine with the same shape contract and serialized ROIAlign_TRT.mode = 0 (max pooling).
• reproduce.py: deserializes both engines and runs the same feature map, ROI, and batch index through each engine.
• local-summary.json: local GPU evidence from the build-and-patch probe.

Expected output:

• both engines deserialize and execute successfully;
• output shape remains [1, 1, 2, 2];
• control output is [1.5625, 3.0, 7.3125, 8.75];
• malicious output is [2.5, 3.28125, 7.0, 7.65625].

Tested with TensorRT 11.1.0.106 on RTX 4090.