Downloads · 30 days
0
tensorflow-savedmodel-mainop-save-scanner-bypass-poc
shiyamganesh/tensorflow-savedmodel-mainop-save-scanner-bypass-poc
tensorflow-savedmodel-mainop-save-scanner-bypass-poc is a machine learning model from shiyamganesh. Use it for the machine learning task on the model card, and read the license before you ship it in a product. It is set up for tf-keras. The card lists the license as mit.
This repository contains PoC files for a TensorFlow SavedModel model-file vulnerability candidate.
Access
Public
Updated May 8, 2026
Repo size
1.5 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.md15 KB · 25%
At a glance
- Library
- tf-keras
- License
- mit
- Access
- Public
- Created
- May 8, 2026
- Updated
- May 8, 2026
- SHA
- 3902ea88
Model card
From the Hugging Face model README
TensorFlow SavedModel saved_model_main_op Save/SaveV2 scanner differential PoC
This repository contains PoC files for a TensorFlow SavedModel model-file vulnerability candidate.
Summary
The PoC demonstrates that TensorFlow SavedModel can execute Save and SaveV2 checkpoint-writing operators from saved_model_main_op during model loading through the TensorFlow C API.
The serving output remains benign, but model loading creates files on disk.
The scanner differential is that ModelScan 0.8.8 flags a WriteFile control SavedModel as HIGH risk, while equivalent load-time filesystem-writing Save and SaveV2 main-op SavedModels produce zero issues.
Main PoC files
tensorflow_savedmodel_save_op_candidate_v5/poc/malicious_save_mainop_savedmodel/saved_model.pbtensorflow_savedmodel_save_op_candidate_v5/poc/malicious_savev2_mainop_savedmodel/saved_model.pbtensorflow_savedmodel_save_op_candidate_v5/poc/control_writefile_mainop_savedmodel/saved_model.pb
Clean verification logs
tensorflow_savedmodel_save_op_candidate_v5/logs/clean_tf_capi_load_time_file_write_repro.logtensorflow_savedmodel_save_op_candidate_v5/logs/clean_modelscan_save_op_no_issues.jsontensorflow_savedmodel_save_op_candidate_v5/logs/clean_modelscan_savev2_op_no_issues.jsontensorflow_savedmodel_save_op_candidate_v5/logs/clean_modelscan_writefile_control_high.json
Clean environment
- Python 3.13.5
- TensorFlow CPU 2.20.0
- ModelScan 0.8.8
Important note
This PoC does not claim arbitrary code execution or TensorFlow memory corruption. It demonstrates a SavedModel scanner/runtime differential and load-time filesystem write via saved_model_main_op.
- Library
- tf-keras
- License
- mit
- Created
- May 8, 2026
- Updated
- May 8, 2026