NNCF

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0-10.0 (Intel Software tier; the $100,000 headline is the Hardware tier) │ Up to $10,000 │ Up to $11,000 High and Medium, CVSS 4.0-8.9 (Intel publishes the Software tier as a whole, not a per-band figure) │ $500 - $10,000 │ $625 - $11,000 Low, CVSS 0.1-3.9 │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Code execution 35 % Parsing/validation 30 % Memory safety 20 % Info disclosure 10 % Latest advisories Loading the feed Overview NNCF is the standard compression step in the OpenVINO workflow: it is what turns a full-precision Hugging Face checkpoint into the INT4 model that runs on a laptop NPU, across PyTorch, TensorFlow, ONNX and OpenVINO IR. That puts it directly on the path where a user downloads an untrusted checkpoint and runs a Python tool over it, which is the single most exploited pattern in AI/ML security to date, and it does so with no CVE history to show where the sharp edges already are. Intel pays for it on Intigriti under the Software tier, where a critical finding reaches up to $10,000 and the floor is $500, and sorona.xyz adds 1.25× on top of whatever Intel awards, up to $1,000 more, plus a complexity bonus of up to $1,000. In scope Intel accepts security issues in open-source projects it solely maintains, and openvinotoolkit is Intel's organisation, so the whole NNCF repository is the target. Recorded honestly: the repository publishes no SECURITY.md, so eligibility rests on org ownership alone. Software is Tier 3 at $500 to $10,000. Post-training quantization and quantization-aware training across all four supported backends: PyTorch, TensorFlow, ONNX and OpenVINO IR The other compression algorithms the framework ships, including weight compression for LLMs on the INT4 and INT8 paths, sparsity, filter pruning and mixed-precision search Model graph ingestion and the backend-agnostic graph representation the algorithms operate on The NNCF configuration parser and the Python API that drives a compression run Checkpoint save and load, including PyTorch pickle-backed state dicts Calibration datasets and the data pipeline the accuracy-aware algorithms consume, plus the nncf package as published on PyPI Out of scope Upstream PyTorch, TensorFlow and ONNX parser bugs that cannot be root-caused to NNCF's own code Accuracy regressions caused by compression, which are a quality problem rather than a security one Pre-release builds and archived branches Notebook and example code shipped for demonstration rather than for production use Duplicates of a finding Intel PSIRT already holds Anything in Intel's *.intel.com web infrastructure, which has its own reporting address Intel's live out-of-scope table on Intigriti lists Intel-maintained open-source projects as out of scope and sends reporters to the project maintainer, which contradicts the scope section admitting projects Intel solely maintains. Confirm eligibility with Intel before committing time. Most-valued findings Code execution triggered by compressing a downloaded checkpoint: the top of the ladder here, and the reason code execution is the largest bug class at 35% A deserialisation path that reaches pickle or an equivalent without the caller having opted into it, in a tool that is routinely run inside CI Config-parser flaws where a crafted NNCF recipe reaches file write, command execution or arbitrary import Model-graph ingestion bugs that cross from one supported format into memory corruption in the shared representation Anything that leaks credentials or model contents out of a compression run into logs, artefacts or exported IR Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Send the report to Intel first and discuss it with nobody Intel has not authorised, video proof-of-concept included The finding must be original, unreported and not already public, and must be demonstrated on a currently supported public release: archived branches pay nothing Pre-release and beta builds are out of scope for bounty rewards One CVE equals one bounty, so a single root cause reachable from several framework backends is paid once You need an Intigriti account, must be 18 or over, must have your employer's approval where it is required, and must clear sanctions screening before Intel can pay This repo publishes no SECURITY.md, so eligibility rests on Intel's ownership of the openvinotoolkit organisation: state that in the report, because Intel's matrix rates open-source software only a "Maybe" for bounty Disclosure Coordinated by Intel PSIRT through the Intel Security Center; the repository publishes no policy of its own. Intel decides when anything becomes public and its non-disclosure clause runs until Intel gives written consent, so sorona.xyz holds the finding until Intel has published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability