Downloads · 30 days
0
modelscan-savedmodel-bypass-poc
xandramax/modelscan-savedmodel-bypass-poc
modelscan-savedmodel-bypass-poc is a machine learning model from xandramax. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Proof-of-concept demonstrating that modelscan v0.8.8's SavedModelTensorflowOpScan blocks only ReadFile and WriteFile, while PrintV2 (which can write arbitrary content to arbitrary files via file:// URI in its outputst…
Access
Public
Updated Apr 5, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.py9.5 KB · 78%
At a glance
- Access
- Public
- Created
- Apr 5, 2026
- Updated
- Apr 5, 2026
- SHA
- 546b6a56
Model card
From the Hugging Face model README
ModelScan SavedModel TF Op Blocklist Bypass PoC
Proof-of-concept demonstrating that modelscan v0.8.8's SavedModelTensorflowOpScan blocks only ReadFile and WriteFile, while PrintV2 (which can write arbitrary content to arbitrary files via file:// URI in its output_stream parameter) passes undetected.
TensorFlow's own saved_model_cli already blocks PrintV2 in its _OP_DENYLIST alongside ReadFile and WriteFile.
Requirements
- Python 3.11+
- TensorFlow 2.x
- modelscan 0.8.8 (commit 61fcec9)
Usage
pip install tensorflow
git clone https://github.com/protectai/modelscan /tmp/modelscan
cd /tmp/modelscan && git checkout 61fcec9
python3 poc-savedmodel-modelscan-bypass.py
What It Does
- Enumerates dangerous TF ops that pass modelscan's blocklist
- Builds a SavedModel with
PrintV2(output_stream="file:///tmp/...")payload - Scans with modelscan -- confirms 0 issues (false negative)
- Loads and calls the model -- confirms arbitrary file write executes
Tested On
- macOS (Apple Silicon)
- TensorFlow 2.21.0
- modelscan v0.8.8 (commit 61fcec9, clean checkout)
- Created
- Apr 5, 2026
- Updated
- Apr 5, 2026