hacnho/tf-savedmodel-assetfiledef-dos-poc

TensorFlow SavedModel asset_file_def cardinality amplification PoC

This repository hosts a benign security research PoC for a TensorFlow SavedModel load-time denial of service.

Files

• saved_model.pb
• variables/variables.index
• variables/variables.data-00000-of-00001
• fingerprint.pb

Reproduction

OPENBLAS_NUM_THREADS=1 python3 - <<'PY'
import tensorflow as tf
m = tf.saved_model.load(".")
print(type(m).__name__)
PY

Observed on the research machine:

• saved_model.pb is about 70.9 MB
• it declares 3,000,000 asset_file_def entries
• tf.saved_model.load() still succeeds but peak RSS reaches roughly 1.24 GB

Safety note

This artifact is a non-executable malformed model-file PoC for parser-stress testing only.