wasi-nn: load_by_name seems insecure

[yamt]

our load_by_name implementation seems to trust host filename given by wasm modules blindly.
i consider it a security issue.

other runtimes (wasmtime, wasmedge) seem to have a concept of model registry, preloaded models, etc.
to me, it seems like a more reasonable design we should follow.

[lum1n0us]

our load_by_name implementation seems to trust host filename given by wasm modules blindly.

Yes, there is no similar consideration in the current WAMR wasi-nn implementation. I think it is useful, and it would be great if the community could contribute this feature.

[yamt]

IMO, it's a bug, not feature.

[yamt]

i guess this should be a per-instance configuration like wasi mapdir.
a dictionary of name -> loaded model.

[yamt]

wasmedge seems to have --nn-preload cli option, which takes Name:Encode:Target:Path:Path:Path:...
eg. --nn-preload default:GGML:AUTO:llama-2-7b-chat-q5_k_m.gguf

wasmtime seems to have --wasi=nn-graph=<encoding>::<path>

[yamt]

i'm thinking embedder apis like the following:

struct wasi_nn_graph_registry;

wasi_nn_error
wasi_nn_graph_registry_create(struct wasi_nn_graph_registry **registryp);

void
wasi_nn_graph_registry_destroy(struct wasi_nn_graph_registry *registry);

// the implementation might eagerly preload the given graph, or might defer
// it until wasi-nn load-by-name is actually called for the name.
// the users of this api should not rely on either behaviors.
wasi_nn_error
wasi_nn_graph_registry_register_graph(struct wasi_nn_graph_registry *registry,
                                      const char *name, const char *builders[],
                                      uint32 nbuilders, const char *ecnoding,
                                      const char *target);

// this might fail if the graph is currently in-use. or this might just mark
// the graph "unregistered" so that it will be ignored for later operations.
// the users of this api should not rely on either behaviors.
wasi_nn_error
wasi_nn_graph_registry_unregister_graph(struct wasi_nn_graph_registry *registry,
                                        const char *name);

// TODO: somehow make wasm_runtime_instantiate_with_wasi associate
// wasi_nn_graph_registry to the instance.
// cf. https://github.com/bytecodealliance/wasm-micro-runtime/issues/4364