hacnho/tensorizer-metadata-amplification-poc

Tensorizer metadata amplification PoC

This repository contains a benign security research proof of concept for a valid .tensors artifact that forces Tensorizer to materialize a very large metadata index during TensorDeserializer(..., lazy_load=True) initialization.

Files

• tensorizer_meta_1000000.tensors - replay artifact with 1000000 metadata entries
• build-meta.json - file-size and measurement summary
• requirements.txt - minimal Python dependencies for local replay
• reproduce_tensorizer_metadata_amp.py - minimal replay helper
• repro.sh - one-command local reproduction
• measure_tensorizer_metadata_amp.py - full builder and measurement harness

What it demonstrates

The artifact is only about 45 MB, but Tensorizer eagerly reads and indexes the full metadata table before any actual tensor payload is lazily loaded.

In the saved local measurement:

• file size is about 45.0 MB
• TensorDeserializer(..., lazy_load=True) adds about 760 MB RSS
• initialization takes about 7.2 s

Quick repro

Install a Python environment with:

• tensorizer==2.12.1
• psutil
• torch

Then run:

bash repro.sh

Expected output shape:

{
  "ok": true,
  "len": 1000000,
  "elapsed_ms": 7189.915,
  "rss_delta": 760512512
}

This PoC is intended for defensive validation and bug bounty triage only.