Intel Neural Compressor

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0-10.0 (Intel Software tier; the $100,000 headline is the Hardware tier) │ Up to $10,000 │ Up to $11,000 High and Medium, CVSS 4.0-8.9 (Intel publishes the Software tier as a whole, not a per-band figure) │ $500 - $10,000 │ $625 - $11,000 Low, CVSS 0.1-3.9 │ $500 │ $625 Submit a vulnerability CVE history 1 Last 12 months 8 Lifetime Code execution 35 % Parsing/validation 30 % Access control 15 % Info disclosure 15 % Latest advisories Loading the feed Overview Neural Compressor is the reference quantization toolchain for Intel CPU inference, wired into Hugging Face Optimum, ONNX Runtime tooling and Intel's own AI reference kits, and covering quantization, pruning, distillation and mixed precision across PyTorch, TensorFlow and ONNX Runtime backends. It is routinely run over checkpoints pulled from public model hubs inside CI pipelines, which is what turns an ordinary deserialisation bug here into a build-system compromise rather than a local crash. No CVE has been filed against it in NVD or OSV, which reflects attention rather than hardness. Intel pays for it on Intigriti under the Software tier, where a critical finding reaches up to $10,000 and the floor is $500, and sorona.xyz adds 1.25× on top of whatever Intel awards, up to $1,000 more, plus a complexity bonus of up to $1,000. In scope Intel accepts security issues in open-source projects it solely maintains. Neural Compressor sits in the intel GitHub organisation and its SECURITY.md routes reports to the Intel Security Center, which is the cleanest form of that test anywhere in Intel's AI stack. Software is Tier 3 at $500 to $10,000, and the target is the whole repository. The compression APIs in full: quantization, pruning, distillation and mixed precision, and the algorithm implementations behind each of them The backend adaptors, neural_compressor.torch and neural_compressor.tensorflow along with the ONNX Runtime path, including everywhere they reach into framework internals Recipe and configuration handling: the YAML and JSON parsers that drive a tuning run and the Python API that consumes them Model, checkpoint and calibration-dataset loading, whatever the source Auto-tuning strategy execution, which evaluates user-supplied Python objects, and the benchmarking and evaluation harness wrapped around it The neural_compressor package as published on PyPI and the entry points other tools reach it through, Hugging Face Optimum and ONNX Runtime tooling included Out of scope Upstream PyTorch, TensorFlow and ONNX Runtime bugs that cannot be root-caused to this codebase Archived sibling projects such as intel/intel-extension-for-transformers, which fall under Intel's end-of-life exclusion Accuracy or performance regressions from compression, which are not security issues Example scripts and notebooks shipped for demonstration rather than for production use Pre-release and beta builds, which Intel puts out of scope for bounty rewards Anything in Intel's *.intel.com web infrastructure, which has its own reporting address Intel's live out-of-scope table on Intigriti lists Intel-maintained open-source projects as out of scope and sends reporters to the project maintainer, which contradicts the scope section admitting projects Intel solely maintains. Confirm eligibility with Intel before committing time. Most-valued findings Code execution reached by running the toolkit over a checkpoint or dataset from a public hub inside CI: the top-paying shape here, and why code execution is the largest bug class at 35% Recipe-parser flaws where a crafted YAML or JSON config reaches import, subprocess or arbitrary file write during a tuning run Auto-tuning strategy evaluation that executes attacker-supplied Python outside the boundary the caller believed it had set Calibration-dataset or model-loading paths that traverse out of the intended directory or fetch from an attacker-controlled location Anything that exposes credentials, tokens or model contents from a build pipeline into logs or exported artefacts Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Send the report to Intel first and discuss it with nobody Intel has not authorised, video proof-of-concept included The finding must be original, unreported and not already public, and must be demonstrated on a currently supported public release: archived and end-of-life repositories pay nothing Pre-release, beta and release-candidate builds are out of scope for bounty rewards One CVE equals one bounty, so a single root cause reachable through the PyTorch, TensorFlow and ONNX adaptors alike is paid once You need an Intigriti account, must be 18 or over, must have your employer's approval where it is required, and must clear sanctions screening before Intel can pay Disclosure Coordinated by Intel PSIRT through the Intel Security Center, which is where the repository's SECURITY.md sends reporters. Intel sets the timing and its non-disclosure clause runs until Intel gives written consent, so sorona.xyz holds the finding until Intel has published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability