---
tags:
  - security
  - proof-of-concept
  - tfrecords
license: mit
---

# TFRecords SequenceExample feature_list materialization DoS PoC

This repository contains a benign security research PoC for a `.tfrecords`
artifact that drives large protobuf materialization during
`tf.train.SequenceExample.FromString(...)`.

Files:

- `control_same_size.tfrecords`
- `malicious_sequenceexample_featurelist_2000000.tfrecords`
- `reproduce.py`

Observed behavior:

- control artifact:
  - parses successfully with one feature entry
- malicious artifact:
  - same size as control
  - parses successfully with `2,000,000` feature entries
  - increases peak RSS by about `269648 kB`
  - takes about `37.58x` the control parse time

Tested runtime:

- `tensorflow==2.21.0`
- clean interpreter: `/tmp/tf221clean/bin/python`

Public files:

- `https://huggingface.co/hacnho/tfrecord-sequenceexample-featurelist-materialization-dos-poc/resolve/main/control_same_size.tfrecords`
- `https://huggingface.co/hacnho/tfrecord-sequenceexample-featurelist-materialization-dos-poc/resolve/main/malicious_sequenceexample_featurelist_2000000.tfrecords`
- `https://huggingface.co/hacnho/tfrecord-sequenceexample-featurelist-materialization-dos-poc/resolve/main/reproduce.py`

Reproduction:

```bash
TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 build_poc.py
TF_PYTHON_BIN=/tmp/tf221clean/bin/python python3 reproduce.py
```