Fix/ort runtime optimization trust

[Akshay Sonawane (apsonawane)]

This pull request introduces a new session option to control the replay of saved runtime optimizations from ORT format models, enhancing security and configurability. By default, replaying saved runtime optimizations is now disabled and must be explicitly enabled for trusted models. The changes also update tests and documentation to reflect this new behavior.

Session Option for Saved Runtime Optimizations

• Added a new session option session.enable_saved_runtime_optimizations (constant kOrtSessionOptionsConfigEnableSavedRuntimeOptimizations) to control whether saved runtime optimizations are replayed. The default is "0" (disabled), and it must be set to "1" to enable replay for trusted models.
• Updated the OrtFormatLoadOptions struct so that saved runtime optimizations are ignored by default unless explicitly enabled.
• Modified the model loading logic in InferenceSession::LoadOrtModelWithLoader to check the new session option and set ignore_saved_runtime_optimizations accordingly. [1] [2]

Test and Documentation Updates

• Updated unit tests to cover scenarios with saved runtime optimizations both enabled and disabled, including adding explicit tests for the default (disabled) behavior and updating test helpers to accept the new option. [1] [2] [3] [4] [5] [6] [7] [8] [9]
• Updated documentation and warning messages in the Python model conversion tool and model readme files to clarify that replay must be enabled explicitly and only for trusted models. [1] [2] [3]

[Copilot]

Pull request overview

This PR introduces a new session config option to control whether saved runtime optimizations embedded in ORT-format models are replayed, changing the default behavior to disabled unless explicitly enabled for trusted models. This tightens security around applying graph-rewrite instructions that come from model files.

Changes:

• Added session.enable_saved_runtime_optimizations (kOrtSessionOptionsConfigEnableSavedRuntimeOptimizations) and wired it into ORT-model loading so replay is opt-in.
• Changed OrtFormatLoadOptions default to ignore saved runtime optimizations unless explicitly enabled.
• Updated unit tests and conversion/docs messaging to reflect the new opt-in behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/python/util/convert_onnx_models_to_ort.py	Updates CLI help and adds a runtime-style warning explaining the new opt-in session option.
onnxruntime/test/testdata/squeezenet/model_opset11.with_runtime_opt.readme.txt	Documents that loading this ORT model with replay now requires the new session option.
onnxruntime/test/optimizer/runtime_optimization/graph_runtime_optimization_test.cc	Enables replay explicitly where needed and adds a test asserting replay is disabled by default.
onnxruntime/test/internal_testing_ep/internal_testing_tests.cc	Updates the NHWC/static-kernel test helper to explicitly enable replay when required.
onnxruntime/test/framework/ort_model_only_test.cc	Extends update test helper to optionally enable replay; adds coverage around models with saved runtime optimizations.
onnxruntime/core/session/inference_session.cc	Gates replay of saved runtime optimizations on the new session config option (default off).
onnxruntime/core/graph/ort_format_load_options.h	Changes default to ignore saved runtime optimizations by default; updates comment.
include/onnxruntime/core/session/onnxruntime_session_options_config_keys.h	Adds the new public session option key constant with documentation.

Suppressed comments (1)

onnxruntime/test/framework/ort_model_only_test.cc:634

• This TestOrtModelUpdate invocation is currently formatted as a single very long line, unlike the surrounding calls in this file. This is likely to violate the repo's C++ formatting/line-length conventions and makes the lambda harder to read. Please reformat the call similarly to the earlier TestOrtModelUpdate usage above.

  TestOrtModelUpdate(onnx_file, ort_file_v4, ort_file_v5, [&](NameMLValMap& inputs, std::vector<std::string>& output_names) {
                       constexpr int n = 3;  // number of QDQ convs

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.