CVE-2025-46153

Executive Summary

CVE-2025-46153 describes a logical inconsistency in PyTorch's bernoulli_p decomposition function within decompositions.py. This function is used when fallback_random=True is set, which affects the behavior of nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d. The decomposition does not fully align with the eager CPU implementation, leading to incorrect dropout masks. This can cause models to behave unpredictably during inference or training, potentially leaking information or degrading performance. The vulnerability is present in PyTorch versions before 3.7.0.

Supply Chain & Package Security

This vulnerability resides in the PyTorch Python package, a critical component of the AI/ML supply chain. Organizations using PyTorch for model training or inference are affected. The issue is not a remote code execution but a logic flaw that can undermine the statistical properties of dropout layers, which are used for regularization. This could lead to models that are less robust or have unexpected behavior, impacting the integrity of AI-driven systems.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating no official score has been assigned. However, based on the technical impact, a reasonable assessment would be:

• Attack Vector (AV): Local (L) – Requires local access to run a model.
• Attack Complexity (AC): Low (L) – Simple to trigger by using affected layers.
• Privileges Required (PR): None (N) – No special privileges needed.
• User Interaction (UI): None (N) – No user action required beyond running the model.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): Low (L) – Potential information leakage through model behavior.
• Integrity (I): Low (L) – Model outputs may be incorrect.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is not remotely exploitable but can degrade model reliability and security in AI pipelines.

Deep Dive & Mechanics

The bernoulli_p function in decompositions.py is used to generate a Bernoulli-distributed mask for dropout operations when fallback_random=True. The eager CPU implementation uses a specific random number generation and thresholding logic. The decomposition version, however, may use a different algorithm or parameterization, leading to masks that do not have the exact statistical properties expected.

For example, the eager implementation might use torch.rand_like(x) < p while the decomposition might use torch.bernoulli(torch.full_like(x, p)). These can produce different results due to floating-point precision or random number generation differences. This inconsistency means that nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d will not correctly zero out elements with probability p, potentially causing overfitting or information leakage.

Vulnerable vs. Patched Code

Vulnerable (PyTorch < 3.7.0):

# decompositions.py (simplified)
def bernoulli_p(input, p, generator=None):
    # Inconsistent decomposition
    return torch.bernoulli(torch.full_like(input, p), generator=generator)

Patched (PyTorch 3.7.0):

# decompositions.py (simplified)
def bernoulli_p(input, p, generator=None):
    # Consistent with eager CPU
    return torch.rand_like(input, dtype=torch.float32, generator=generator) < p

The patched version uses torch.rand_like with a comparison, matching the eager CPU implementation.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to craft a model that uses nn.Dropout1d, nn.Dropout2d, or nn.Dropout3d with fallback_random=True. The goal would be to cause the model to behave differently than intended, potentially leaking information or causing misclassification.

Lab Setup:

1. Install PyTorch 3.6.x: pip install torch==3.6.0
2. Create a simple model with dropout:

import torch
import torch.nn as nn

class ExploitModel(nn.Module):
    def __init__(self):
        super().__init__()
        self.dropout = nn.Dropout1d(p=0.5, inplace=False)
    
    def forward(self, x):
        return self.dropout(x)

model = ExploitModel()
model.eval()
x = torch.ones(1, 10, 10)
with torch.no_grad():
    output = model(x)
    # Observe that the dropout mask may not zero out exactly 50% of elements
    print("Fraction zeroed:", (output == 0).float().mean().item())

3. Compare with the eager CPU implementation by setting fallback_random=False (if available) or using a patched version.

Blue Team

Detection involves monitoring for unusual model behavior or statistical anomalies in dropout layers.

Detection Steps:

1. Monitor model outputs for unexpected variance.
2. Check PyTorch version: python -c "import torch; print(torch.__version__)"
3. Audit code for use of fallback_random=True in dropout layers.
4. Implement statistical tests to verify dropout behavior.

Indicators of Compromise (IOCs)

• File: decompositions.py containing the vulnerable bernoulli_p function.
• Behavior: Models using nn.Dropout1d, nn.Dropout2d, or nn.Dropout3d with fallback_random=True produce inconsistent masks.
• Version: PyTorch < 3.7.0.

Detection Engineering

YARA Rule

rule CVE_2025_46153_PyTorch_Bernoulli_Decomp {
    meta:
        description = "Detects vulnerable bernoulli_p decomposition in PyTorch"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-46153"
    strings:
        $vuln_func = "def bernoulli_p" nocase
        $vuln_call = "torch.bernoulli" nocase
        $vuln_full = "torch.full_like" nocase
    condition:
        $vuln_func and $vuln_call and $vuln_full
}

Sigma Rule

title: CVE-2025-46153 PyTorch Bernoulli Decomposition
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects use of vulnerable bernoulli_p decomposition in PyTorch
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'torch'
    condition: selection
falsepositives:
    - Legitimate use of PyTorch
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46153 PyTorch Bernoulli Decomposition"; flow:to_server; content:"torch"; nocase; content:"bernoulli_p"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade PyTorch: Update to version 3.7.0 or later.
2. Avoid fallback_random=True: If upgrade is not possible, avoid using fallback_random=True in dropout layers.
3. Code Audit: Review all uses of nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d in your codebase.
4. Model Validation: After patching, re-validate model behavior to ensure consistency.

Valters IT
Securing AI/ML Pipelines