The model specified in the article is not identified by the TensorDetect

[galmo-noma]

The following model, which reads a file using one of the APIs specified in the paper, is not caught by the TensorDetected
Model creation example, which reads a file with a single digit number and multiplies the input with it. It works perfectly, yet not being detected by the TensorDetected

import tensorflow as tf

class MaliciousModel(tf.Module):
    def __init__(self):
        super().__init__()
        self.a = tf.Variable(3.0)  # Normal-looking model variable

    @tf.function
    def __call__(self, x):
        # Use tf.data API to read from file indirectly
        
        dataset =tf.compat.v1.raw_ops.FixedLengthRecordDatasetV2(
            filenames=["/Users/user/test.txt"],
            record_bytes=1,
            header_bytes=0,
            footer_bytes=0,
            buffer_size=1024,
            compression_type="",
        ).map(lambda x: tf.strings.to_number(x, out_type=tf.float32))

        # Take the first value from the dataset
        multiplier = next(iter(dataset))  # Extract first value

        return multiplier * x  # Perform multiplication

# Create an instance of the model
model = MaliciousModel()

export_dir = "./saved_malicious_model"
tf.saved_model.save(model, export_dir)
print("Model saved!")

Looking at the code, it seems the saved model does not include the FixedLengthRecordDatasetV2 API for some reason, but rather the following operator names

['VarHandleOp', 'ReadVariableOp', 'Placeholder', 'StatefulPartitionedCall', 'NoOp', 'Const', 'Placeholder', 'StatefulPartitionedCall', 'StatefulPartitionedCall', 'StatefulPartitionedCall', 'Identity', 'NoOp', 'Const', 'Const', 'RestoreV2', 'Identity', 'AssignVariableOp', 'NoOp', 'Identity', 'Identity', 'NoOp', 'EagerPyFunc', 'Mul', 'Identity', 'NoOp', 'StaticRegexFullMatch', 'Const', 'Const', 'Select', 'StringJoin', 'DisableCopyOnRead', 'ReadVariableOp', 'Identity', 'Identity', 'Const', 'Const', 'ShardedFilename', 'Const', 'Const', 'SaveV2', 'Pack', 'MergeV2Checkpoints', 'Identity', 'Identity', 'NoOp']

Can you please advise why this malicious model was not detected?

[unsatisfying]

Hello,

I think it is a version issue.
First, you use the tf.compat.v1 version API，which will not be saved in the model. I suggest you to use the tf.raw_ops.FixedLengthRecordDatasetV2 instead.
Second, you should use a proper TensorFlow version and python version. (My environment is TF==2.15.0 and python==3.10.8)
Third, if you use the tf.raw_ops.FixedLengthRecordDatasetV2 API, it has no map function. So you have to do some inherit operation to make it iterable.

For some ethical reason, I cannot show you the PoC directly, so you can contact on me by email.

[unsatisfying]

The following model, which reads a file using one of the APIs specified in the paper, is not caught by the TensorDetected Model creation example, which reads a file with a single digit number and multiplies the input with it. It works perfectly, yet not being detected by the TensorDetected

import tensorflow as tf

class MaliciousModel(tf.Module):
    def __init__(self):
        super().__init__()
        self.a = tf.Variable(3.0)  # Normal-looking model variable

    @tf.function
    def __call__(self, x):
        # Use tf.data API to read from file indirectly
        
        dataset =tf.compat.v1.raw_ops.FixedLengthRecordDatasetV2(
            filenames=["/Users/user/test.txt"],
            record_bytes=1,
            header_bytes=0,
            footer_bytes=0,
            buffer_size=1024,
            compression_type="",
        ).map(lambda x: tf.strings.to_number(x, out_type=tf.float32))

        # Take the first value from the dataset
        multiplier = next(iter(dataset))  # Extract first value

        return multiplier * x  # Perform multiplication

# Create an instance of the model
model = MaliciousModel()

export_dir = "./saved_malicious_model"
tf.saved_model.save(model, export_dir)
print("Model saved!")

Looking at the code, it seems the saved model does not include the FixedLengthRecordDatasetV2 API for some reason, but rather the following operator names

['VarHandleOp', 'ReadVariableOp', 'Placeholder', 'StatefulPartitionedCall', 'NoOp', 'Const', 'Placeholder', 'StatefulPartitionedCall', 'StatefulPartitionedCall', 'StatefulPartitionedCall', 'Identity', 'NoOp', 'Const', 'Const', 'RestoreV2', 'Identity', 'AssignVariableOp', 'NoOp', 'Identity', 'Identity', 'NoOp', 'EagerPyFunc', 'Mul', 'Identity', 'NoOp', 'StaticRegexFullMatch', 'Const', 'Const', 'Select', 'StringJoin', 'DisableCopyOnRead', 'ReadVariableOp', 'Identity', 'Identity', 'Const', 'Const', 'ShardedFilename', 'Const', 'Const', 'SaveV2', 'Pack', 'MergeV2Checkpoints', 'Identity', 'Identity', 'NoOp']

Can you please advise why this malicious model was not detected?

Hello, I have update all PoCs. You can have a look at them.