onnx-duplicate-output-name-poc

ONNX ReferenceEvaluator Duplicate Output-Name Silent Value Shadowing

Status: Preparing for Huntr submission Package: onnx (PyPI) — onnx.reference.ReferenceEvaluator File / function: onnx/reference/reference_evaluator.py, ReferenceEvaluator.run() Class: CWE-706 (Use of Incorrectly-Resolved Name) + CWE-20 Severity: Medium-High — silent, general graph-level data substitution, not a crash.

Summary

ReferenceEvaluator.run() executes graph nodes sequentially and stores each one's output in a plain dict keyed by name:

for name, value in zip(node.output, outputs):
    ...
    results[name] = value

There is no check that a node's declared output name doesn't collide with one already present in results — each subsequent node whose output shares a name with an earlier one silently overwrites the earlier value.

The official checker catches this — but ReferenceEvaluator doesn't use it

onnx.checker.check_model() — a separate, independent structural validator shipped in the same package — correctly detects and rejects this exact situation: "Graph must be in single static assignment (SSA) form, however 'x' has been used as output names multiple times."

However, ReferenceEvaluator does not call check_model() internally before executing a graph, and the standard, primary, documented usage pattern — ReferenceEvaluator(model_or_path) used directly — does not require or automatically invoke the checker first. Anyone using ReferenceEvaluator through its normal API without separately and manually pre-validating with onnx.checker.check_model() is exposed to this despite the checker technically existing elsewhere in the package.

Proof of Concept

poc_onnx_duplicate_output_name.py builds a minimal ONNX model with two Constant nodes that both declare output name "x" (values 1.0 and 999.0), feeding an Identity node.

pip install onnx
python poc_onnx_duplicate_output_name.py

Result

=== onnx.checker.check_model() (the official separate structural validator) ===
  -> correctly REJECTED: ValidationError: Graph must be in single static assignment (SSA) form, however 'x' has been used as output names multiple times.

=== ReferenceEvaluator(model).run() (the standard, primary usage pattern -- does NOT call the checker first) ===
  -> 'x' resolved to: [999.]

ReferenceEvaluator returns 999.0 — the second Constant node's value — with no error, even though the official checker would have rejected the exact same model as structurally invalid if it had been called first.

Impact

A crafted ONNX model can declare two or more nodes producing an output with the same name. Any downstream node consuming that name silently receives whichever value was computed last during sequential execution, not what a casual reader of the graph structure might expect. This can be used to make a graph appear to reference one set of values (e.g. legitimate constants or weights) while an operation that's supposed to consume them silently receives a different, later-computed value instead.

Suggested fix

Have ReferenceEvaluator reject duplicate output names during execution (or at model-load time), either by calling onnx.checker.check_model() internally by default, or by independently validating the SSA invariant before running.

Relationship to other findings

Distinct from 6 previously reported findings in the same module (ConstantOfShape/Tile/Expand/Range/MelWeightMatrix/Col2Im/MaxUnpool — all CWE-789 unbounded-allocation issues, unrelated root cause). This is the same broad pattern family — duplicate identifier leading to silent "wins" resolution so real data becomes unreachable — independently confirmed this session in gguf-py (tensor offset aliasing, first-wins), ollama/ollama's Go GGUF parser (duplicate tensor names, first-wins), sklearn-pmml-model (duplicate VectorInstance id, first-wins), and coremltools' MIL graph loader (duplicate op output names, last-wins) — five independent implementations across five different model-format ecosystems, all missing the same class of uniqueness validation.

Disclosure

Please do not use this PoC against production systems you do not own or have explicit permission to test.