polish: address reviewer feedback on PR #28083

- Add missing silently-ignore comment in backend.py prepare()
- Improve exclusion comment style to per-attribute in backend.py
- Fix circular self-reference in run_model() docstring
- Rewrite SKILL.md rule 3 for cold readers
- Add error message assertion to test_run_model_with_blocked_run_option_raises
- Add tests for unknown kwargs through rep.run() and run_model()

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Agent-signed-off: Developer (1003864e) [claude-opus-4.6]
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: titaiwangms

.agents/skills/python-kwargs-setattr-security/SKILL.md

@@ -42,7 +42,7 @@ for k, v in kwargs.items():
 
 1. **Use the existing object** in `hasattr(options, k)` — never `hasattr(ClassName(), k)` (creates throwaway C++ objects per iteration)
 2. **RuntimeError** is the ORT convention for API misuse errors (not ValueError)
-3. **Silent ignore for RunOptions** when the same kwargs are forwarded from a SessionOptions path (e.g. `run_model()` sends kwargs to both `prepare` and `rep.run`)
+3. **Silent ignore for one path is OK when kwargs are forwarded to both paths**: `run_model()` passes the same kwargs dict to both `prepare()` (validates SessionOptions) and `rep.run()` (validates RunOptions). A RunOptions kwarg unknown to SessionOptions is silently ignored by `prepare()` — this is correct because `rep.run()` will validate it. Only raise RuntimeError when the attr exists on the target object but is blocked.
 4. **Frozenset constant naming**: `_ALLOWED_<CLASSNAME>` — ALL_CAPS, Google Style
 5. **No type annotations** on module-level constants (ORT Python convention)
 

onnxruntime/python/backend/backend.py

@@ -18,8 +18,10 @@
 from onnxruntime.backend.backend_rep import OnnxRuntimeBackendRep
 
 # Allowlist of SessionOptions attributes that are safe to set via the backend API.
-# Dangerous attributes (e.g. optimized_model_filepath, profile_file_prefix, enable_profiling)
-# are intentionally excluded to prevent arbitrary file writes through user-controlled kwargs.
+# Dangerous attributes intentionally excluded:
+#   optimized_model_filepath  — triggers Model::Save(), overwrites arbitrary files
+#   profile_file_prefix       — writes profiling JSON to arbitrary path
+#   enable_profiling          — causes uncontrolled file writes to cwd
 _ALLOWED_SESSION_OPTIONS = frozenset(
     {
         "enable_cpu_mem_arena",
@@ -140,6 +142,7 @@ def prepare(cls, model, device=None, **kwargs):
                         f"SessionOptions attribute '{k}' is not permitted via the backend API. "
                         f"Allowed attributes: {', '.join(sorted(_ALLOWED_SESSION_OPTIONS))}"
                     )
+                # else: silently ignore unknown keys
 
             excluded_providers = os.getenv("ORT_ONNX_BACKEND_EXCLUDE_PROVIDERS", default="").split(",")
             providers = [x for x in get_available_providers() if (x not in excluded_providers)]
@@ -182,7 +185,7 @@ def run_model(cls, model, inputs, device=None, **kwargs):
             None means the default one which depends on
             the compilation settings
         :param kwargs: accepted keys are the union of ``_ALLOWED_SESSION_OPTIONS``
-            (see ``backend.py``) and ``_ALLOWED_RUN_OPTIONS`` (see ``backend_rep.py``).
+            (defined in this module) and ``_ALLOWED_RUN_OPTIONS`` (see ``backend_rep.py``).
             Kwargs are passed directly to both ``prepare()`` and ``rep.run()``; each
             validates against its own allowlist and raises ``RuntimeError`` for blocked
             attributes. Logging-related kwargs (``log_severity_level``,

onnxruntime/test/python/onnxruntime_test_python_backend.py

@@ -158,8 +158,26 @@ def test_run_model_with_blocked_run_option_raises(self):
         """run_model() must raise RuntimeError when given a blocked RunOptions attribute."""
         name = get_name("mul_1.onnx")
         x = np.array([[1.0, 2.0], [3.0, 4.0], [5.0, 6.0]], dtype=np.float32)
-        with self.assertRaises(RuntimeError):
+        with self.assertRaises(RuntimeError) as ctx:
             backend.run(name, [x], terminate=True)
+        self.assertIn("not permitted", str(ctx.exception))
+
+    def test_unknown_kwarg_is_silently_ignored_in_run(self):
+        """A kwarg unknown to RunOptions must be silently ignored by rep.run()."""
+        name = get_name("mul_1.onnx")
+        rep = backend.prepare(name)
+        x = np.array([[1.0, 2.0], [3.0, 4.0], [5.0, 6.0]], dtype=np.float32)
+        res = rep.run(x, completely_unknown_key="bar")
+        output_expected = np.array([[1.0, 4.0], [9.0, 16.0], [25.0, 36.0]], dtype=np.float32)
+        np.testing.assert_allclose(res[0], output_expected, rtol=1e-05, atol=1e-08)
+
+    def test_unknown_kwarg_is_silently_ignored_in_run_model(self):
+        """An unknown kwarg must be silently ignored by both prepare() and rep.run() in run_model()."""
+        name = get_name("mul_1.onnx")
+        x = np.array([[1.0, 2.0], [3.0, 4.0], [5.0, 6.0]], dtype=np.float32)
+        res = backend.run(name, [x], completely_unknown_key="baz")
+        output_expected = np.array([[1.0, 4.0], [9.0, 16.0], [25.0, 36.0]], dtype=np.float32)
+        np.testing.assert_allclose(res[0], output_expected, rtol=1e-05, atol=1e-08)
 
     def test_run_model_with_blocked_session_option_raises(self):
         """run_model() must raise RuntimeError when given a blocked SessionOptions attribute."""