TinyML Model Loading: Verify FlatBuffer Structure Before Calling the Micro Runtime

A model loader checks the schema version and then crashes during tensor allocation. The version comparison did not establish that the received bytes were safe to traverse. In TFLM, model parsing and validation are separate responsibilities.

Use a length-bounded validation boundary before handing a model to the micro runtime. Then distinguish structural verification from model-reference checks and the selected kernels' supported configurations.

GetModel is an accessor, not a validator

The pinned generated model header implements GetModel through FlatBuffers' root accessor. It accepts a pointer without a buffer length. Reading model->version() after that call already traverses the supplied data; a version check cannot safely precede validation of an arbitrary truncated file.

The same header supplies VerifyModelBuffer, which invokes the generated model verifier with the TFL3 identifier. Checking that identifier alone only recognizes a format tag. It does not walk the tables and vectors or establish their bounds.

Verify the bytes that were actually received

The official FlatBuffers C++ guide describes constructing a verifier with the buffer pointer and its actual length. Generated verification checks offsets, field sizes and string termination before ordinary accessors are used.

For an ordinary, non-size-prefixed TFLite model, the relevant sequence is flatbuffers::Verifier verifier(data, received_size) followed by tflite::VerifyModelBuffer(verifier). Reject failure before calling model accessors. Use the matching FlatBuffers dependency and generated schema from the runtime checkout.

Do not substitute allocated capacity for received length: unused trailing memory is not part of the downloaded model. Similarly, the generated size-prefixed verification entry point is for that different encoding, not an extra safety option for a normal .tflite file. Configure reasonable verifier work limits for the accepted model class rather than assuming every structurally valid object graph is affordable.

Integer references need a separate model-level check

A verified vector can still contain an invalid tensor index. The generated Operator::Verify checks that the inputs vector is structurally accessible, but does not compare each stored integer with the containing subgraph's tensor count. Its opcode-index field is likewise not a proof that the referenced operator-code entry exists.

The pinned TFLM defensive-programming guide explicitly warns that the runtime assumes valid model structure and does not provide ordinary production bounds checks for every operator tensor index. It assigns validation of externally supplied models to the application layer.

Define model-level validation for the accepted schema: tensor and opcode references, buffer references, required fields and the permitted representation of optional inputs. Do not reject every negative input index blindly; optional-input conventions need to be interpreted in context. Run these checks only after safe structural traversal has been established.

Keep compatibility checks after the loading boundary

The guide recommends setup-time checks for shapes, types, quantization parameters and allocations. That is a kernel-authoring policy, not evidence that every selected implementation validates every possible malformed model. Neither a successful FlatBuffer verification nor a matching schema version proves that the resolver and kernels support the graph.

Exercise the boundary with separate test categories: truncated storage, a damaged table offset, a structurally valid but invalid tensor reference, and a supported structure with an unsupported operator configuration. Specify which layer should reject each case. These are proposed tests, not executed results.

Finally, verification does not establish model authenticity or application accuracy. Apply the product's model-authorization policy independently, and preserve the validated bytes through runtime use. A useful loader reports which boundary failed instead of treating every allocation failure as insufficient arena memory.