hacnho/pt2-tensor-values-amplification-poc

Torch Export PT2 tensor_values amplification PoC

This repository contains a benign security research proof of concept for a valid .pt2 artifact whose models/model.json contains 100000 unused graph.tensor_values entries.

Files

• poc-tensor-values-100k.pt2 - valid PT2 artifact with 100000 extra unused tensor metadata entries
• build-meta.json - artifact size and entry count
• reproduce_pt2_tensor_values_amp.py - local replay helper

What it demonstrates

torch.export.load() still materializes all graph.tensor_values entries, even if they are not referenced by graph inputs, graph outputs, or graph nodes.

In the local measurement:

• file size is about 17.40 MB
• torch.export.load() takes about 11.6 s
• ru_maxrss grows by about 394 MB

Quick repro

Install:

• torch==2.8.0

Then run:

python reproduce_pt2_tensor_values_amp.py poc-tensor-values-100k.pt2

Expected output shape:

{
  "file_size": 17395933,
  "elapsed_ms": 11634.58,
  "ru_maxrss_before": 332120064,
  "ru_maxrss_after": 725958656
}

This PoC is intended for defensive validation and bug bounty triage only.