[ML] Port TorchScript graph validation and __setstate__ hardening to 8.19

[edsavage]

Summary

• Port the TorchScript graph-validation stack from 9.4 onto 8.19 (CModelGraphValidator, CSupportedOperations, pre-load __setstate__/__getstate__ archive scan, allowlist tooling/tests).
• Restores model-graph validation on 8.19 after the Mar 2026 revert ([8.19] [ML] Harden pytorch_inference with TorchScript model graph validation (#2936) #2988 → Revert "[8.19] [ML] Harden pytorch_inference with TorchScript model graph validation (#2936)" #2998); aligns 8.19 with the validation surface already on 9.4/9.5 ([ML] Reapply: Harden pytorch_inference with TorchScript model graph validation #3008 / Harden model validation: reject __setstate__ hooks and forbid inductor::_reinterpret_tensor #3078) so future backports apply cleanly.
• C++17 adaptation only: replace unordered_set::contains with find() (8.19 is still C++17).

Seccomp ABI checks and controller non-dumpable hardening are already on 8.19 via #3106 / #3107.

Test plan

• Local macOS aarch64: pytorch_inference + ml_test_pytorch_inference build
• Local: CModelGraphValidatorTest — no errors
• CI: pytorch tests (ci:run-pytorch-tests)
• CI: QA / inference scenarios (ci:run-qa-tests) — important given Mar 2026 allowlist fallout on quantized/default endpoints
• Confirm default ELSER / rerank paths still load under the allowlist on Linux

[elasticsearchmachine]

Pinging @elastic/ml-core (Team:ML)

[elasticsearchmachine]

Hi @edsavage, I've created a changelog YAML for you.

[Copilot]

Pull request overview

This PR ports the TorchScript model graph validation stack and __setstate__/__getstate__ load-time hardening onto the 8.19 branch for pytorch_inference, restoring and extending the previously reverted validator work with additional pre-load protections and tooling.

Changes:

• Add a C++ TorchScript graph validator (CModelGraphValidator) backed by an explicit allowlist/forbidlist (CSupportedOperations) and wire it into pytorch_inference model loading.
• Harden model loading by statically scanning the TorchScript archive for custom state hooks before calling torch::jit::load, plus add a kill-switch flag to skip validation.
• Add/port unit tests, malicious-model fixtures tooling, and developer utilities/CMake targets to validate allowlist coverage against reference models.

Reviewed changes

Copilot reviewed 15 out of 46 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/test_setstate_load_timing.py	Standalone Python repro for __setstate__ executing during torch.jit.load() and being invisible to forward-only validation.
test/test_pytorch_inference_evil_models.py	Python integration script generating “evil” models and verifying the binary rejects them.
test/CMakeLists.txt	Adds validate_pytorch_inference_models custom target to run allowlist validation tooling.
docs/changelog/3130.yaml	Changelog entry for the backport/hardening work.
dev-tools/generate_malicious_models.py	Utility to generate malicious TorchScript fixtures used by validator tests.
dev-tools/extract_model_ops/validation_models.json	Model set used for allowlist validation (HF + Elastic + QA coverage).
dev-tools/extract_model_ops/validate_allowlist.py	Parses C++ allow/forbid sets and validates traced model ops against them.
dev-tools/extract_model_ops/torchscript_utils.py	Shared tracing/op-collection utilities for allowlist tools.
dev-tools/extract_model_ops/requirements.txt	Python dependencies for the allowlist tooling environment.
dev-tools/extract_model_ops/reference_models.json	Reference architectures whose ops define the allowlist baseline.
dev-tools/extract_model_ops/README.md	Documentation for extracting ops, validating allowlist, and regenerating golden files.
dev-tools/extract_model_ops/extract_model_ops.py	Tool to trace reference models and produce allowlist/golden output.
dev-tools/extract_model_ops/es_it_models/README.md	Docs for the bundled ES IT .pt fixtures and regeneration steps.
dev-tools/extract_model_ops/.gitignore	Ignore venv directory used by tooling.
cmake/run-validation.cmake	CMake script to create a venv, install deps, and run allowlist validation.
bin/pytorch_inference/unittest/testfiles/reference_model_ops.json	Golden file of per-model op sets for allowlist drift detection.
bin/pytorch_inference/unittest/CThreadSettingsTest.cc	Updates includes to use public-style include paths.
bin/pytorch_inference/unittest/CResultWriterTest.cc	Updates includes to use public-style include paths.
bin/pytorch_inference/unittest/CModelGraphValidatorTest.cc	New unit/integration tests covering validator behavior, fixtures, and pre-load hook scan.
bin/pytorch_inference/unittest/CMakeLists.txt	Adds validator test file and include path config for unit tests.
bin/pytorch_inference/unittest/CCommandParserTest.cc	Updates includes to use public-style include paths.
bin/pytorch_inference/Main.cc	Wires in pre-load archive scan + post-load validation; adds --skipModelValidation flow.
bin/pytorch_inference/CSupportedOperations.h	Declares allowlist/forbidlist sets for model op validation.
bin/pytorch_inference/CSupportedOperations.cc	Defines allowlist/forbidlist sets (incl. inductor::_reinterpret_tensor) for validation.
bin/pytorch_inference/CModelGraphValidator.h	Declares validator API and pre-load archive scanning helper.
bin/pytorch_inference/CModelGraphValidator.cc	Implements graph op collection + allow/forbid matching + archive scan for state hooks.
bin/pytorch_inference/CMakeLists.txt	Adds new validator/operations sources to the pytorch_inference build.
bin/pytorch_inference/CCmdLineParser.h	Extends CLI parse signature to return skipModelValidation.
bin/pytorch_inference/CCmdLineParser.cc	Adds --skipModelValidation option and parsing.
bin/pytorch_inference/CBufferedIStreamAdapter.h	Exposes buffered model bytes for pre-load archive scanning.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[edsavage]

buildkite run_qa_tests for ES_BRANCH=8.19 with STACK_VERSION=8.19.20