---
license: other
tags:
  - security
  - vulnerability-research
  - proof-of-concept
  - tensorflow
  - savedmodel
  - not-a-model
viewer: false
---

# ⚠️ Security PoC — NOT a usable model

Proof-of-concept malicious **TensorFlow SavedModel** files for a [huntr](https://huntr.com)
"Model Format Vulnerability" submission (Protect AI / Palo Alto Prisma AIRS). They
write attacker-chosen files when run, while being reported **clean by Protect AI
ModelScan**. Published only for responsible-disclosure reproduction — do not run
them on a machine you care about.

## What it demonstrates

ModelScan's SavedModel scanner only denylists two ops (`ReadFile`, `WriteFile`).
TensorFlow has many other file-I/O ops; embedding them gives the same arbitrary
file write while the scanner reports 0 issues.

| Dir | Op | Effect | ModelScan |
|-----|----|--------|-----------|
| `evil_printv2` | `PrintV2` (`tf.print(..., output_stream="file://PATH")`) | writes attacker **content** to attacker **path** | **0 issues** |
| `evil_savev2` | `SaveV2` | writes checkpoint files at attacker path | **0 issues** |
| `naive_writefile` | `WriteFile` (control) | same impact | **HIGH — detected** |

## Reproduce

```bash
pip install tensorflow modelscan
python build_tf_poc.py            # regenerates the three SavedModels
python load_run.py evil_printv2   # inference -> writes PWNED_printv2.txt (attacker content)
modelscan -p evil_printv2 -r json # -> total_issues: 0  (bypass)
modelscan -p naive_writefile      # -> HIGH Tensorflow.WriteFile  (control is caught)
```
(ModelScan must be installed with the `tensorflow` extra so its SavedModel scanner actually parses the graph.)

## Files
- `evil_printv2/`, `evil_savev2/`, `naive_writefile/` — the SavedModel PoCs
- `build_tf_poc.py` — regenerates them deterministically
- `load_run.py` — loads a SavedModel and runs inference (triggers the write)