TF_GraphCopyFunction(host_graph_, func_, grad_func, s_);
  ASSERT_EQ(TF_OK, TF_GetCode(s_)) << TF_Message(s_);

  // Verify that function and its grad are in host graph's GraphDef
  GraphDef gdef;
  GetGraphDef(host_graph_, &gdef);
  std::vector<string> func_names = GetFuncNames(gdef);
  ASSERT_EQ(2, func_names.size());
  ASSERT_EQ(func_name_, func_names[0]);

    TF_LOCKS_EXCLUDED(session->graph->mu, session->mu);

std::string getTF_OutputDebugString(TF_Output node);

// Set whether to propagate assigned device information when constructing a new
// Graph from a GraphDef. By default assigned device information is not copied
// and is re-computed by the runtime.
inline void TF_ImportGraphDefOptionsSetPropagateDeviceSpec(
    TF_ImportGraphDefOptions* opts, unsigned char propagate_device_spec) {

  TF_DeleteExecutionContext(graph_ctx);
}

// The above tests are run for a combination of:
// - graphdef and MLIR tracing engine
INSTANTIATE_TEST_SUITE_P(Tracing, UnifiedCAPI,
                         ::testing::Combine(::testing::Values("graphdef",
                                                              "mlir"),
                                            ::testing::Values(false)));

should be used with caution when working with untrusted models.

### Saved graphs and checkpoints

When loading untrusted serialized computation graphs (in form of a `GraphDef`,
`SavedModel`, or equivalent on-disk format), the set of computation primitives
available to TensorFlow is powerful enough that you should assume that the
TensorFlow process effectively executes arbitrary code.

*   The Python API will now properly set the `list` member of `AttrValue` in
    constructed `GraphDef` messages for empty lists. The serialization of some
    graphs will change, but the change is both forwards and backwards
    compatible. It will break tests that compare a generated `GraphDef` to a
    golden serialized `GraphDef` (which is discouraged).

## Thanks to our Contributors