---
tags:
  - security
  - proof-of-concept
  - tfrecords
license: mit
---

# TFRecords BytesList value materialization DoS PoC

This repository contains a benign security research PoC for a `.tfrecords`
artifact that drives large protobuf materialization during
`tf.train.BytesList.FromString(...)`.

Files:

- `control_same_size.tfrecords`
- `malicious_byteslist_value_10000000.tfrecords`
- `reproduce.py`

Observed behavior:

- control artifact:
  - parses successfully with one `value` item
- malicious artifact:
  - same size as control
  - parses successfully with `10,000,000` `value` items
  - increases peak RSS by about `407764 kB`
  - takes about `14.62x` the control parse time

Reproduction:

```bash
TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 build_poc.py
TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 reproduce.py
```