Downloads · 30 days
4
8% of all-time downloads
modelscan-tf-printv2-op-bypass-poc
celvexgroup/modelscan-tf-printv2-op-bypass-poc
modelscan-tf-printv2-op-bypass-poc is a machine learning model from celvexgroup. Use it for the machine learning task on the model card, and read the license before you ship it in a product. It is set up for tf-keras. The card lists the license as apache-2.0.
Coordinated-disclosure proof-of-concept submitted to Protect AI via huntr (Model File Vulnerability).
All-time downloads
48
Public
Repo size
8.4 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.pb8.4 KB · 76%
At a glance
- Library
- tf-keras
- License
- apache-2.0
- Access
- Public
- Created
- Jul 1, 2026
- Updated
- Jul 1, 2026
- SHA
- 075d884c
Model card
From the Hugging Face model README
Benign PoC — modelscan TF SavedModel op-denylist bypass (PrintV2)
Coordinated-disclosure proof-of-concept submitted to Protect AI via huntr (Model File Vulnerability).
saved_model.pb is a TensorFlow SavedModel graph containing a PrintV2 node with
output_stream="file://<path>" — an arbitrary-file-write operator that modelscan does not flag
(modelscan's unsafe_tf_operators denylist is only {ReadFile, WriteFile}).
Reproduce
pip install tensorflow modelscan
modelscan -p saved_model.pb # -> "No issues found" (the bypass)
A control SavedModel that uses the denylisted WriteFile op is flagged HIGH by modelscan, proving the
scanner works but misses PrintV2. Corroboration: TensorFlow's own saved_model_cli.py denylists
PrintV2 (_OP_DENYLIST = {'WriteFile','ReadFile','PrintV2'}) — modelscan is a strict subset.
Strictly benign: when executed, the graph only writes a harmless marker string (CELVEX-MFV-MARKER)
to a temp file. No weaponization. Confirmed against released modelscan 0.8.8.
- Library
- tf-keras
- License
- apache-2.0
- Created
- Jul 1, 2026
- Updated
- Jul 1, 2026