Skip to content

GPUCC-MODEL-01: Model/weights bootstrap store rejects injection-shaped object writes

Property Value
Severity high
Platform NVIDIA GPU Confidential Computing
Lifecycle stage deploy
Trust boundary inputs
Assurance probed
Mode Active: writes and then removes probe objects. Skipped with --read-only.

What a failure enables

  • Attacker code runs inside the attested workload

What it checks

It passes when:

  • Model store refused all … injection-shaped canary writes (writes are not open to the audit identity).

Example failures:

  • Model store accepted …/… injection-shaped object writes across classes: …. A loader that joins these names onto a local path without sanitizing gets attacker weights or arbitrary file write (boot-time model poisoning).
  • Model store accepted …/… injection-shaped object writes across classes: …. A loader that joins these names onto a local path without sanitizing gets attacker weights (boot-time model poisoning).

How to fix

  • Scope object-write on the model store to the attested workload identity only, and sanitize downloaded object names inside the TEE: reject names whose normalized path escapes the model directory, decode once and re-check, and refuse absolute paths. Prefer digest-pinned, signed weights.
  • Scope model-store writes to the attested identity; sanitize names.

After the fix, scan again: the check should report PASS.

When it is not assessed

SKIP:

  • No --gpu-model-bucket specified; skipping check.

ERROR:

  • Could not initialize model-store probe: …

Scan inputs

The untrust scan options this check reads:

Option Description
--gcp-project GCP project ID.
--gpu-model-bucket Object store holding model weights (injection probe).

Permissions

The cloud API calls this check makes, read from the scanner's source:

Cloud API call Permission Access
Google Cloud storage.Blob.upload_from_string storage.objects.create write
Google Cloud storage.Blob.delete storage.objects.delete write

See Required permissions for every check on this platform.

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).