celvexgroup/modelaudit-tf-savedmodel-debugidentityv2-poc

PoC - modelaudit + modelscan miss tf.raw_ops.DebugIdentityV2 (arbitrary-dir file write on load) (BL-0119)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign CELVEX markers only.

• Scanners: modelaudit==0.2.49 (tf_savedmodel_scanner) AND modelscan==0.8.8 (saved_model scan). Format: TensorFlow SavedModel (.pb). Repro TF 2.21.0.
• bypass_debugdump/saved_model.pb routes a tensor through tf.raw_ops.DebugIdentityV2(tensor_debug_mode=FULL_TENSOR, debug_urls=['file://<attacker_dir>']). On tf.saved_model.load()+call() the tfdbg2 DebugEventsWriter creates 6 tfdbg_events.* files inside the attacker-controlled directory (arbitrary-directory file WRITE, load-side confirmed). Both scanners: Clean / exit 0 / issue_count 0.
• Positive control control_writefile/saved_model.pb (tf.raw_ops.WriteFile, identical save path): modelaudit CRITICAL exit 1 ('Dangerous TensorFlow operation: WriteFile', function __inference_run_48, node WriteFile) + modelscan HIGH exit 1 -- fires in the SAME function walk, so the DebugIdentityV2 Clean is a real op-level miss, not a dead scanner. benign_trueneg/saved_model.pb -> both Clean (true-negative baseline).
• Root cause: modelaudit detectors/suspicious_symbols.py:566 SUSPICIOUS_OPS + :611 TENSORFLOW_DANGEROUS_OPS omit DebugIdentityV2 (and all tfdbg ops); tf_savedmodel_scanner.py:140/1700/1749 are pure membership tests. modelscan scanners/saved_model/scan.py:77-83 + settings.py:50-53 unsafe_tf_operators={ReadFile,WriteFile} -> every other public tf.raw_ops op hits the continue (safe) branch.
• HONEST: shares the broad 'TF op denylist is systematically incomplete' class with submitted BL-0084 (SaveSlices) / BL-0088 (InitializeTableFromTextFileV2 et al.), but is a DISTINCT op + subsystem (TF debugger tfdbg2 DebugEventsWriter, looks like an inert Identity). FULL_TENSOR value-exfil-to-disk did NOT reproduce without an explicit writer flush; claimed only as by-design capability. Confirmed primitive = arbitrary-dir file WRITE. Fix: add tfdbg + file/dir-writing + network raw_ops to the denylist; modelscan should not treat every public tf.raw_ops op as safe.

Files: bypass_debugdump/saved_model.pb (bypass, Clean on both), control_writefile/saved_model.pb (positive control, fires on both), benign_trueneg/saved_model.pb (true-negative). Full report in huntr submission.