Unveiling the Perils of the TorchScript Engine in PyTorch
Ji'an Zhou, Lishuo Song
DEF CON 33 · Day 1 · Main Stage
This DEF CON 33 talk—titled in full "Safe Harbor or Hostile Waters: Unveiling the Hidden Perils of the TorchScript Engine in PyTorch"—presents a systematic security analysis of PyTorch's TorchScript e
AI review
Zhou and Song from Alibaba Cloud systematically broke TorchScript's 'safe serialization' narrative, finding type confusion, use-after-free, filesystem access primitives, and SSRF in the TorchScript VM — all reachable through normal model loading with CVEs issued prior to disclosure.