modelaudit-executorch-pte-substring-evasion-poc

PoC - modelaudit ExecuTorch .pte flatbuffers binary route runs no pickle-opcode analysis; STACK_GLOBAL pickle evades both scanners (BL-0121)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign markers only; pickles are NEVER deserialized (only pickle.dumps at build + static scan).

• Scanners: modelaudit==0.2.49 (executorch_scanner + pytorch_binary_scanner) AND modelscan==0.8.8. Format: ExecuTorch .pte (flatbuffers binary, identifier ET+digits).
• modelaudit scan pte_evade_stackglobal.pte -> Scanner 'executorch', 8/8 checks pass incl 'Valid ExecuTorch binary program' and 'Embedded Code Pattern Detection: No suspicious code patterns detected', 0 issues, success TRUE, exit 0. modelscan -p pte_evade_stackglobal.pte -> total_scanned=0, exit 3 (no flatbuffers route). Both Clean.
• Positive controls (byte-identical protocol-4 STACK_GLOBAL posix.system pickle): payload_stackglobal.pkl -> modelaudit CRITICAL S201 ('REDUCE opcode invoking dangerous global: posix.system') + modelscan CRITICAL. pt_zip_evade_datapkl.pt (same pickle as torch-zip data.pkl) -> both CRITICAL. So the payload is genuinely dangerous and detectable; the .pte binary route is the sole evasion vector.
• Contrast pte_naive_global.pte: the protocol-2 GLOBAL-opcode form of the SAME call in a .pte DOES trip modelaudit's substring denylist (WARNING S902 posix\nsystem) -- proving the binary route intends to detect embedded pickles, but only via a literal substring list. STACK_GLOBAL emits \x8c\x05posix\x8c\x06system\x93 (module/name split, no contiguous denylisted substring) -> evades. benign.pte -> both Clean (true-negative baseline).
• Root cause: modelaudit executorch_scanner.py:1334-1338 (valid non-zip ExecuTorch binary calls ONLY _merge_raw_binary_analysis -> PyTorchBinaryScanner; archive pickle-opcode discovery never reached); pytorch_binary_scanner.py:34-56 + detectors/suspicious_symbols.py:506-545 (literal substring denylist, no STACK_GLOBAL byte / no REDUCE / no bare system). modelscan format_via_extension.py:7-17 + settings.py:77-84 (extension-only format resolution, no .pte entry -> total_scanned=0). Fix: run opcode-aware pickle analysis over the ExecuTorch binary body (not just the substring list); modelscan should content-route or fail loud on unrecognized model formats.
• Benign: payload is posix.system('echo CELVEX_MFV_LABONLY...'). Scanner protection-mechanism-failure / detection-evasion (a pure .pte is not auto-executed by the ExecuTorch runtime), corroborated by modelscan scanning nothing.

Files: pte_evade_stackglobal.pte (bypass, Clean on both), payload_stackglobal.pkl + pt_zip_evade_datapkl.pt (positive controls, fire CRITICAL on both), pte_naive_global.pte (contrast, WARNING - detector live), benign.pte (true-negative). Full report in huntr submission.