---
tags:
- security
- tensorizer
- scanner-bypass
- model-weights
---

# Tensorizer Scanner Bypass PoC

This repository contains a minimal public proof of concept for a Tensorizer
`torch_compat` scanner/runtime mismatch confirmed on Wednesday, July 29, 2026.

## Contents

- `model.pt`
  - SHA-256: `e8c3ed20b97ab1dd80c0edfc5be90eff1b1ab96171d5f8645f43417062115887`
- `model.pt.tensors`
  - SHA-256: `c3d456f90d58561f7d06a12fab74990d9c7ee30c82db34d98591326526bd409f`
- `benign_sidecar.tensors`
  - SHA-256: `eece8a4c501927d7ba6f2d465a6a0752154e2e15972e247fd57a0d0170ff89de`
- `model_bundle.zip`
  - SHA-256: `e6b5841ac899f5620538ebc4fd270cf2eb7d51ddff99d52c9f4e3503450c42cf`
- `scanner_bypass_repro.py`
  - SHA-256: `f178c249113ffcf8c93af1142d1c486fb593448f7c7b48ea4ffcffa1c53fb998`

## What This Demonstrates

The public `tensorizer.torch_compat.tensorizer_loading()` workflow can load
weights from the default sidecar file `model.pt.tensors` while the tested
scanners only inspect the `.pt` metadata file and skip or fail to inspect the
`.tensors` payload.

Using the same `model.pt`:

- benign sidecar output: `1.0 1.0`
- malicious sidecar output: `1.0 -99.0`

## Reproduction

Environment used in the audit:

- `tensorizer 2.12.1`
- `torch 2.13.0+cpu`
- confirmed on Wednesday, July 29, 2026

Install requirements:

```bash
python3 -m pip install tensorizer==2.12.1 torch==2.13.0
```

Load the malicious default-path sidecar with the public Tensorizer wrapper:

```python
import torch
from tensorizer.torch_compat import tensorizer_loading

with tensorizer_loading(device="cpu"):
    state_dict = torch.load("model.pt")

print(state_dict["weight"].tolist())
```

Expected output:

```text
[[1.0, -100.0]]
```

Run the full comparison:

```bash
python3 scanner_bypass_repro.py
```

Expected output:

```text
model.pt sha256: e8c3ed20b97ab1dd80c0edfc5be90eff1b1ab96171d5f8645f43417062115887
benign sidecar sha256: eece8a4c501927d7ba6f2d465a6a0752154e2e15972e247fd57a0d0170ff89de
malicious sidecar sha256: c3d456f90d58561f7d06a12fab74990d9c7ee30c82db34d98591326526bd409f
benign outputs: 1.0 1.0
malicious outputs: 1.0 -99.0
```

## Scanner Notes

During the July 29, 2026 audit:

- ModelScan reported `No issues found!` while skipping `.tensors`.
- Picklescan reported `Infected files: 0` and `Dangerous globals: 0`.

The bundle `model_bundle.zip` contains the same `model.pt` and
`model.pt.tensors` pair used in the confirmed runtime repro.