hacnho/tf-savedmodel-object-graph-call-retarget-poc

TensorFlow SavedModel object_graph __call__ retarget PoC

This repository contains a benign security research proof of concept for a TensorFlow SavedModel whose loaded __call__ behavior is silently retargeted through object_graph_def.concrete_functions.

Uploaded files:

• control_savedmodel/
• malicious_savedmodel_object_graph_call/
• reproduce.py

Tested runtime:

• tensorflow==2.19.0
• numpy==1.26.4
• modelscan==0.8.8

Observed behavior:

• tf.saved_model.load(control)(tf.constant(2.0)) returns 3.0
• tf.saved_model.load(malicious)(tf.constant(2.0)) returns 102.0
• both models still return 3.0 through loaded.signatures["serving_default"](x=tf.constant(2.0))

Reproduction:

python reproduce.py control_savedmodel malicious_savedmodel_object_graph_call