phonglanvq/tensorizer-scanner-bypass-poc-20260729

Tensorizer Scanner Bypass PoC

This repository contains a minimal public proof of concept for a Tensorizer torch_compat scanner/runtime mismatch confirmed on Wednesday, July 29, 2026.

Contents

• model.pt
  • SHA-256: e8c3ed20b97ab1dd80c0edfc5be90eff1b1ab96171d5f8645f43417062115887
• model.pt.tensors
  • SHA-256: c3d456f90d58561f7d06a12fab74990d9c7ee30c82db34d98591326526bd409f
• benign_sidecar.tensors
  • SHA-256: eece8a4c501927d7ba6f2d465a6a0752154e2e15972e247fd57a0d0170ff89de
• model_bundle.zip
  • SHA-256: e6b5841ac899f5620538ebc4fd270cf2eb7d51ddff99d52c9f4e3503450c42cf
• scanner_bypass_repro.py
  • SHA-256: f178c249113ffcf8c93af1142d1c486fb593448f7c7b48ea4ffcffa1c53fb998

What This Demonstrates

The public tensorizer.torch_compat.tensorizer_loading() workflow can load weights from the default sidecar file model.pt.tensors while the tested scanners only inspect the .pt metadata file and skip or fail to inspect the .tensors payload.

Using the same model.pt:

• benign sidecar output: 1.0 1.0
• malicious sidecar output: 1.0 -99.0

Reproduction

Environment used in the audit:

• tensorizer 2.12.1
• torch 2.13.0+cpu
• confirmed on Wednesday, July 29, 2026

Install requirements:

python3 -m pip install tensorizer==2.12.1 torch==2.13.0

Load the malicious default-path sidecar with the public Tensorizer wrapper:

import torch
from tensorizer.torch_compat import tensorizer_loading

with tensorizer_loading(device="cpu"):
    state_dict = torch.load("model.pt")

print(state_dict["weight"].tolist())

Expected output:

[[1.0, -100.0]]

Run the full comparison:

python3 scanner_bypass_repro.py

Expected output:

model.pt sha256: e8c3ed20b97ab1dd80c0edfc5be90eff1b1ab96171d5f8645f43417062115887
benign sidecar sha256: eece8a4c501927d7ba6f2d465a6a0752154e2e15972e247fd57a0d0170ff89de
malicious sidecar sha256: c3d456f90d58561f7d06a12fab74990d9c7ee30c82db34d98591326526bd409f
benign outputs: 1.0 1.0
malicious outputs: 1.0 -99.0

Scanner Notes

During the July 29, 2026 audit:

• ModelScan reported No issues found! while skipping .tensors.
• Picklescan reported Infected files: 0 and Dangerous globals: 0.

The bundle model_bundle.zip contains the same model.pt and model.pt.tensors pair used in the confirmed runtime repro.