YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
Arm NN FlatBuffers Layer-Order Trigger PoC
This repository contains two synthetic Arm NN FlatBuffers models that demonstrate a layer-ID versus vector-position metadata split. The files contain no code, credentials, network behavior, file access, or persistence.
The models contain the same uniquely ID-addressed graph. The trigger model only swaps the serialized vector order of two input-layer records.
| file | SHA-256 |
|---|---|
armnn-mfv-trigger-canonical.armnn |
fd163cc1412a529b457c64c4b6914cd467bec227a08132028a84008828ae3661 |
armnn-mfv-trigger-mismatched.armnn |
baa783a4bc6f6ba0ea129073718d37763c3cf1eb77151c754b4cc22641321775 |
Reproduction
Use ARM-software/armnn@2b61cecc9df7a43fca1463795062cf359e6be820
with the reference backend and deserializer enabled. Compile
reproduce_armnn_trigger.cpp from the Arm NN source root. The verified command
uses the in-tree include directory and Release build directory:
g++ -O2 -std=c++17 \
-Iinclude -Lbuild-release -Wl,-rpath,"$PWD/build-release" \
/path/to/reproduce_armnn_trigger.cpp \
-larmnnDeserializer -larmnn \
-o reproduce_armnn_trigger
The semantic oracle was verified with flatc version 23.5.26. Then run:
./reproduce_armnn_trigger armnn-mfv-trigger-canonical.armnn
./reproduce_armnn_trigger armnn-mfv-trigger-mismatched.armnn
python3 verify_trigger_split_view.py /path/to/armnn/src/armnnSerializer/ArmnnSchema.fbs
Expected output:
MODEL=armnn-mfv-trigger-canonical.armnn INPUT=8 TRIGGER=0
MODEL=armnn-mfv-trigger-mismatched.armnn INPUT=8 TRIGGER=1
ID_NORMALIZED_GRAPHS_IDENTICAL=1
ID_AWARE_TRIGGER=0 ARMNN_TRIGGER=1
The Python oracle decodes both files with the pinned ArmnnSchema.fbs, sorts
the layer records by serialized ID, proves that the normalized graphs are
identical, and independently computes the ID-aware and positional outcomes.
This PoC demonstrates trigger-specific silent inference-output manipulation. It does not claim scanner bypass, code execution, memory corruption, data access, credential access, or persistence.