aviral2642/safetensors-toctou-poc

Safetensors TOCTOU PoC

Security research — TOCTOU race condition in safetensors PyTorch loading

This repository demonstrates a validation bypass vulnerability in the safetensors library. The Python bindings open the model file twice during PyTorch loading (once for Rust validation, once for PyTorch's UntypedStorage.from_file()), creating a TOCTOU window where the file can be swapped between validation and data loading.

Files

• model.safetensors — Clean model file (benign weights)
• model_benign.safetensors — Benign weights (class 0 classifier)
• model_poison.safetensors — Poisoned weights (backdoored to class 1)
• exploit_symlink.py — PoC exploit via symlink swap (99.4% success rate)
• exploit_race.py — PoC exploit via atomic file rename (58% success rate)
• create_model.py — Script to regenerate model files

Reproduction

pip install safetensors torch
python create_model.py
python exploit_symlink.py

Affected

• safetensors <= 0.7.0 (all versions with PyTorch >= 1.11.0)
• All downstream: transformers, diffusers, accelerate, etc.