An Intrinsic Security Issue in Tensorflow: The Potential Threats During the Training Phase

Deep learning models trained using deep learning libraries have become the cornerstone of various applications, spanning domains from healthcare to autonomous systems. Ensuring the security and reliability of these systems is critically important. Due to the vulnerabilities in deep learning libraries and the black-box nature of deep learning models, these models face significant security threats. This paper discovers the threats posed by TensorFlow's SavedModel format and high-risk APIs, analyzing how attackers can exploit them to embed malicious logic into models and constructing a threat model within the training process. SavedModel format files provide exceptional flexibility by serializing computational graphs and custom logic, which may unintentionally expand the attack surface. This expanded attack surface poses significant security risks, enabling threats such as malicious code propagation and network message transmission. These risks are demonstrated through practical examples. Additionally, we systematically evaluated the characteristics of these threats, examining the differences and stealthiness between compromised models and normal models.