modelaudit-surrealml-surml-onnx-offset-blindspot-poc

PoC - modelaudit ONNX detection blind spot in SurrealML .surml container header offset (BL-0118)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign markers only; nothing executes.

• Scanner: modelaudit==0.2.49 (utils/file/detection.py content-based format detection). Format: SurrealML .surml carrying an ONNX model.
• modelaudit scan --format json malicious_wrapped.surml -> detect 'unknown', scanner_names [], issues [], success TRUE, exit 0. The IDENTICAL ONNX bytes scanned bare (malicious_bare.onnx) -> detect 'onnx', success FALSE, 8 issues incl 4x CRITICAL (ONNX PyOp arbitrary-code-exec; CVE-2022-25882 + CVE-2025-51480 external_data path traversal), exit 1 -> positive control, detector is LIVE.
• DECISIVE control: extension_only_no_header.surml is the bare ONNX with ONLY the extension changed to .surml (sha256 == malicious_bare.onnx) -> modelaudit still detects 'onnx' and flags CRITICAL exit 1. This isolates the cause to the .surml header offset (not the extension): modelaudit is content-based, and the 4-byte big-endian header + //=> header block shifts the ONNX ModelProto off offset 0, so _looks_like_onnx_model_proto_stream parses at position 0, resolves field_number 0, and returns not-ONNX.
• Root cause (modelaudit 0.2.49): detection.py:7100 read_magic_bytes() reads at OFFSET 0 only; detection.py:4237/4297 ONNX probe parses at stream pos 0; detection.py:9693/10068 -> 'unknown'; core.py ~:7005 finalizes 'unknown' as success=true, no scanner run. No offset-aware probe for a model embedded after a container header.
• .surml layout reconstructed byte-faithfully from authoritative surrealml-core source (modules/core/src/storage/surml_file.rs to_bytes/from_bytes; header '//=>' delimiter); the embedded ONNX at offset 99 is byte-identical to the bare model (embedded_onnx_verbatim=true) -- i.e. the exact bytes SurrealML hands to ONNX Runtime on load. Reproduce a real .surml with pip install surrealml onnxruntime + SurMlFile(model=<onnx>, engine=Engine.ONNX).save(...).
• Benign: the ONNX PyOp/external_data payload references a /tmp CELVEX_BENIGN_MARKER only. File-borne detection-evasion, not standalone RCE. modelscan 0.8.8 has no ONNX scanner (skips all three, exit 3) so this is a modelaudit-specific two-sided gap.

Files: malicious_wrapped.surml (bypass), malicious_bare.onnx (positive control, fires CRITICAL), extension_only_no_header.surml (decisive control, fires). Full report in huntr submission.