LiteRT Security Features: Defense-in-Depth for On-Device Machine Learning

LiteRT implements a defense-in-depth security architecture that treats machine learning models as executable programs, requires sandboxing for untrusted models, and enforces strict input validation through a whitelist of safe formats including PNG, BMP, GIF, WAV, RAW, CSV, and PROTO.

The google-ai-edge/LiteRT repository provides a trusted runtime for on-device machine learning that assumes any model it executes is essentially a program. Because .tflite models contain arbitrary computation graphs, LiteRT security features focus on threat modeling, runtime isolation, and clear vulnerability boundaries to protect against memory corruption and code execution attacks. Understanding these safeguards is essential for developers deploying inference capabilities in production environments.

Threat Model: Treating Models as Executable Programs

According to the project's SECURITY.md, LiteRT operates under a fundamental security assumption: models are programs. Loading a .tflite file is equivalent to running untrusted code because the serialized computation graph can contain arbitrary operations.

As documented in SECURITY.md (lines 8-16), the project explicitly states that "LiteRT models are programs" and that loading untrusted serialized computation graphs means "the LiteRT process effectively executes arbitrary code." This threat model shifts the security burden from assuming model safety to assuming models must be contained.

Runtime Isolation Through Sandboxing

If you must run models from untrusted sources, LiteRT mandates sandboxing as a critical defense mechanism. The security policy in SECURITY.md (lines 18-20) recommends executing untrusted models inside sandboxes such as the Android app sandbox, containers, or OS-level sandboxes to prevent memory-corruption attacks from reaching the host system.

The policy clarifies that memory corruptions in LiteRT ops are only recognized as security issues if they are reachable through production-grade, benign models. Issues requiring the execution of actively malicious models fall outside the standard vulnerability scope.

Input Format Whitelisting and Validation

LiteRT maintains a strict whitelist of safe input formats that have a demonstrated security track record. According to SECURITY.md (lines 45-49), it is considered safe to work with untrusted inputs only for the following formats:

• PNG
• BMP
• GIF
• WAV
• RAW and RAW_PADDED
• CSV
• PROTO

All other input formats must be sandboxed before parsing if used to process untrusted data. This whitelist approach minimizes the attack surface by restricting the parsing code paths exposed to potentially malicious input data.

Vulnerability Scope and Reporting

The project defines clear boundaries for what constitutes a valid security vulnerability. As stated in SECURITY.md (lines 70-73), the team recognizes issues as vulnerabilities only when they occur in recommended safe usage scenarios. Issues that have security impact only when LiteRT is used in discouraged ways—such as running unsandboxed untrusted models—are not treated as vulnerabilities.

For legitimate security findings, the repository directs researchers to the Google Bug Hunters reporting form (SECURITY.md, lines 75-88). The policy encourages responsible disclosure and offers reporters credit for identifying issues while maintaining confidentiality upon request. The main README.md prominently links to this security policy to ensure developer visibility.

Code Examples

Sandboxing Model Execution in Android

Android applications run in their own sandbox by default, providing inherent protection when loading models:

#include "litert/litert.h"

int main() {
  litert::Model model;
  // Load a trusted .tflite model from the app's private assets
  // The Android sandbox prevents compromise from affecting other apps
  model.LoadFromFile("assets/my_trusted_model.tflite");
  // Execute inference within the sandboxed environment
}

This approach aligns with the guidance in SECURITY.md to execute untrusted models inside a sandbox, preventing escalation to the host system through memory corruption vulnerabilities.

Validating Input Formats Against the Safe Whitelist

Before processing user-provided data, validate against the documented safe formats:

import mimetypes
from pathlib import Path
from litert import Runtime

def is_safe_input(file_path: Path) -> bool:
    """Check if input format is in the LiteRT safe whitelist."""
    safe_mimes = {
        'image/png', 'image/bmp', 'image/gif',
        'audio/wav',
        'application/octet-stream',  # RAW / RAW_PADDED

        'text/csv', 'application/protobuf'
    }
    mime = mimetypes.guess_type(file_path)[0]
    return mime in safe_mimes

runtime = Runtime()
input_file = Path("user_uploads/sample.png")

if is_safe_input(input_file):
    runtime.LoadInput(input_file)
else:
    raise ValueError("Untrusted input format – sandbox required")

This validation mirrors the safe-format whitelist defined in SECURITY.md, ensuring that only hardened parsers handle external data.

Reporting Security Issues

When discovering potential vulnerabilities, use the designated reporting channel:

# Submit via Google Bug Hunters (example structure)

curl -X POST \
  -F "title=Buffer overflow in LiteRT image parser" \
  -F "description=Technical details of the vulnerability..." \
  -F "steps=Reproduction instructions..." \
  https://g.co/vulnz

This follows the official vulnerability reporting process documented in SECURITY.md.

Key Source Files for Security Analysis

Several files in the google-ai-edge/LiteRT repository are critical for understanding and auditing security implementations:

• SECURITY.md – The authoritative security policy containing the threat model, sandbox guidance, and safe format whitelist.
• README.md – Provides the primary entry point linking to security documentation (line 11).
• tflite/util.h and tflite/util.cc – Utility code for model loading and validation where parsing vulnerabilities often surface.
• weight_loader/external_weight_loader_litert.h and weight_loader/external_weight_loader_litert.cc – Handle external weight file loading, requiring careful validation of untrusted data sources.
• litert/opensource_only.files – Lists files in the open-source distribution, helping auditors understand the attack surface.

Summary

LiteRT security features provide a comprehensive defense-in-depth strategy for on-device machine learning:

• Treats all models as executable code, requiring the same caution as running untrusted binaries.
• Mandates sandboxing for any untrusted model execution to contain memory corruption attacks.
• Maintains a strict input format whitelist (PNG, BMP, GIF, WAV, RAW, CSV, PROTO) to minimize parser attack surface.
• Defines clear vulnerability boundaries, recognizing only those issues exploitable through recommended usage patterns.
• Provides transparent reporting channels via Google Bug Hunters for responsible disclosure.

Frequently Asked Questions

Does LiteRT automatically sandbox models?

No, LiteRT does not implement automatic sandboxing. According to SECURITY.md (lines 18-20), developers must explicitly execute untrusted models within a sandbox environment such as an Android app sandbox, container, or OS-level sandbox. Running models without sandboxing in production environments is considered a discouraged usage pattern.

Which input formats does LiteRT consider safe for untrusted data?

LiteRT explicitly considers only PNG, BMP, GIF, WAV, RAW, RAW_PADDED, CSV, and PROTO formats safe for processing untrusted inputs. As documented in SECURITY.md (lines 45-49), all other input formats must be sandboxed before parsing to prevent exploitation of vulnerable parsers.

How are security vulnerabilities reported to the LiteRT team?

Security issues must be reported through the Google Bug Hunters form rather than public GitHub issues. The SECURITY.md file (lines 75-88) provides this process, offering researchers credit for discoveries while maintaining confidentiality upon request. This responsible disclosure policy helps ensure vulnerabilities are patched before public disclosure.

Are all crashes in LiteRT treated as security vulnerabilities?

No. The project only recognizes vulnerabilities that occur in recommended usage scenarios as defined in the threat model. According to SECURITY.md (lines 70-73), crashes or memory corruptions that require executing malicious models or processing unsafe formats outside the whitelist are not treated as LiteRT security issues, as these violate the documented security guidelines.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}