TensorFlow.js userDefinedMetadata.signature.outputs output node selection hijack

Target: TensorFlow.js – Google
Route: huntr MFV
Format: GraphModel (.json + .bin)
Field: model.json → userDefinedMetadata.signature.outputs

1. Summary

TensorFlow.js loadGraphModel() reads userDefinedMetadata.signature.outputs from model.json without validation and uses it to select which graph node becomes the model output. A model.json that contains an injected userDefinedMetadata.signature can redirect model.predict() to return the value of a different (intermediate) graph node — while the graph topology, weight binary, and weightsManifest remain identical. No warning or error is emitted.

Confirmed with actual TensorFlow.js runtime:
@tensorflow/tfjs-converter 4.22.0 + @tensorflow/tfjs-backend-cpu 4.22.0
tf.loadGraphModel() + model.predict(tf.tensor([3]))

2. Affected Product

Package: @tensorflow/tfjs-converter
Tested version: 4.22.0
Format: GraphModel — model.json + *.bin weight shard(s)
Not affected: LayersModel (@tensorflow/tfjs-layers) — does not consume userDefinedMetadata

3. Vulnerability Details

Vulnerable code path

graph_model.js lines 147–157 — userDefinedMetadata.signature fully overrides artifacts.signature:

let signature = this.artifacts.signature;
if (this.artifacts.userDefinedMetadata != null) {
    const metadata = this.artifacts.userDefinedMetadata;
    if (metadata.signature != null) {
        signature = metadata.signature;   // ← COMPLETE OVERRIDE, no validation
    }
}

operation_mapper.js — mapSignatureEntries() converts the injected signature to a node-name map:

function mapSignatureEntries(entries) {
    return Object.keys(entries || {}).reduce((prev, curr) => {
        prev[entries[curr].name] = curr;
        return prev;
    }, {});
}

transformGraph() then pushes the named node into graph.outputs[], overriding the default leaf-node selection.

graph_executor.js line 104: this._outputs = graph.outputs — the injected intermediate node becomes the model's output.

Attack

A single field addition to model.json:

"userDefinedMetadata": {
  "signature": {
    "outputs": {
      "output_0": { "name": "Mul" }
    }
  }
}

When name matches any node in modelTopology, model.predict() returns that node's value instead of the intended final output — silently.

4. Impact

model.predict() returns the tensor value of an intermediate graph node rather than the intended final output.
The graph topology, weight binary, and weightsManifest are unchanged.
No warning, exception, or log message is emitted.
A downstream consumer receives a wrong tensor value without any indication.

Scope: GraphModel only. LayersModel is not affected.

5. Proof of Concept

Graph (clean and mutant use identical topology)

Input (Placeholder, float32, shape [1])
  └─→ Mul  (Input × Input = x²)
        └─→ Add  (Mul + Mul = 2x²)    ← default leaf output

For input x = 3: Mul = 9, Add = 18.

Run

npm install
node reproduce_tfjs_signature_outputs_flip.js

Output

clean  predict(3) -> 18  (outputNodes: ["Add"])
mutant predict(3) -> 9   (outputNodes: ["output_0"])

OUTPUT_TENSOR_VALUE_FLIP : true
OUTPUT_NODE_FLIP         : true
WARNING_EMITTED          : false
TFJS_SIGNATURE_OUTPUTS_FLIP_CONFIRMED

Artifact isolation check

node inspect_tfjs_signature_outputs_hash_matrix.js

modelTopology     : IDENTICAL
weightsManifest   : IDENTICAL
weight SHA256     : IDENTICAL
userDefinedMetadata clean  : undefined
userDefinedMetadata mutant : {"signature":{"outputs":{"output_0":{"name":"Mul"}}}}
CHANGED_FIELD_ONLY : userDefinedMetadata.signature.outputs
HASH_MATRIX_PASS

6. Evidence

evidence_runtime_results.json — actual runtime output values (ACTUAL_TFJS_RUNTIME tier)
evidence_reproducibility.json — 8/8 reproducibility (5x same-process + 3x subprocess)
evidence_hash_matrix.json — SHA256 isolation verification
evidence_distinctness_matrix.json — distinctness from 6 prior findings

7. Distinctness from Prior Findings

Root	Field	Format	Consumer	Effect	Overlap
This finding	`userDefinedMetadata.signature.outputs`	TFJS GraphModel .json	`graph_model.js` + `operation_mapper.js`	Wrong intermediate node returned by predict()	—
fc03a614 (SUBMITTED)	`weightsManifest[].weights[].name`	TFJS GraphModel .json	`io_utils.js decodeWeights()`	Wrong weight tensor values at correct output node	NONE
TFLite SignatureDef	FlatBuffer SignatureDef	TFLite .tflite	C++ Task Library	Output key rename	NONE
TFLite AssociatedFile	FlatBuffer label file	TFLite .tflite	C++ Task Library Classifier	Label string substitution	NONE
TFLite NormalizationOptions	FlatBuffer mean/std	TFLite .tflite	C++ Task Library preprocessor	Input rescaled before inference	NONE
OpenVINO rt_info labels	IR XML rt_info	OpenVINO .xml+.bin	openvino-model-api Python	Class label name substitution	NONE

8. Non-Claims

No remote code execution (RCE)
No arbitrary code execution (ACE)
No memory corruption
No scanner bypass as primary claim
Not a LayersModel vulnerability
Does not affect graph topology
Does not affect weight shard bytes
Does not allow creation of graph nodes beyond existing modelTopology
Does not affect @tensorflow/tfjs-node in a manner distinct from pure-JS backend
Not a duplicate of fc03a614 (distinct field, mechanism, code path, and effect)

9. Expected Triage Objections and Responses

O1: "userDefinedMetadata is metadata, not a security boundary."
The TFJS loader uses userDefinedMetadata.signature to directly determine which graph node is evaluated and returned by model.predict(). This is a behavioral control, not a descriptive annotation. The runtime makes no distinction between "authoritative" and "advisory" fields.

O2: "The injected node must already exist in the graph."
Agreed. The constraint only means the attacker must reference a valid node name. Any node in modelTopology is a valid target. The attack does not require graph modification.

O3: "This is just model supply-chain manipulation."
The finding is that the userDefinedMetadata field — which is distinct from the weightsManifest and modelTopology fields — carries behavioral authority that is not validated or disclosed to the consumer.

O4: "Duplicate of the weightsManifest duplicate-name root (fc03a614)."
Field, consumer function, code path, and effect are all different. fc03a614 is about weight tensor value collision in decodeWeights(); this finding is about output node selection override in mapSignatureEntries() + transformGraph().

O5: "Duplicate of TFLite SignatureDef root."
Different format (TFLite FlatBuffer vs JSON), different consumer (C++ vs JavaScript), different runtime path, and different effect (key rename vs node value redirect).

O6: "Only the output key name changes, not the value."
model.predict() returns tensor value 9 (Mul) instead of 18 (Add) — confirmed by actual runtime execution. This is a value change, not a key rename.

O7: "Users should hash the full model.json."
The TFJS runtime provides no built-in model.json integrity mechanism and no warning when userDefinedMetadata.signature overrides inference behavior.

O8: "A model.json change is obvious if inspected."
The override is a JSON field that is not checked by any standard TFJS inspection API. model.outputNodes returns ["output_0"] (the signature key), not the underlying node name, making the redirect opaque to casual review.

10. Recommendation

Add schema validation for userDefinedMetadata.signature in graph_model.js before overriding artifacts.signature, or emit a warning when userDefinedMetadata.signature is present and alters the effective output node set.

11. References

graph_model.js lines 147–157 (signature override)
operation_mapper.js mapSignatureEntries() (output node map)
graph_executor.js line 104 (this._outputs = graph.outputs)
GHSA: 0 advisories for @tensorflow/tfjs-converter
OSV: 0 vulnerabilities for @tensorflow/tfjs-converter (npm)