AeonAIRisk/tflite-micro-decode-prune-padding-backdoor-poc

TFLite Micro DECODE pruning declared-vector boundary PoC

This repository contains a control/trigger model pair for a TFLite Micro pruning-decoder length-validation issue.

Files

• c8-pattern-control.tflite: 664-byte control model
• c8-pattern-trigger.tflite: 664-byte hidden-padding model
• verify_packet.py: fail-closed byte/hash verifier
• runtime-regression-test.patch: regression for the pinned upstream commit

The models differ by one byte at zero-based offset 609. That byte is outside a declared one-byte encoded FlatBuffer vector. Both models pass the TFLite model verifier. With compression enabled, TFLM_DECODE registered, and the decoded tensor used as fully connected weights, two benign inputs remain class 0 in both models and a one-coordinate near miss also remains class 0. The exact alternating-sign pattern [1,-1,1,-1,1,-1,1,-1] remains class 0 in the control and becomes class 1 only in the hidden-padding model.

Verify frozen files

python verify_packet.py

Reproduce in TFLite Micro

Apply runtime-regression-test.patch to commit 096563546742ba81adb6f012ab718d196a48e02d, then run:

make -j1 -f tensorflow/lite/micro/tools/make/Makefile \
  USE_TFLM_COMPRESSION=1 test_kernel_decode_state_prune_test

Expected result: all 11 tests pass, including DeclaredInputLengthMustBoundIndexReads and FlatbufferPaddingMustNotInfluenceOutput, plus FlatbufferPaddingMustNotCreateInputTriggeredBackdoor.

Scope of the claim

This demonstrates deterministic inference-output manipulation through a byte outside the declared encoded vector. It does not claim code execution, process-memory disclosure, remote reachability, or scanner evasion. ModelScan 0.8.8 does not support these TFLite files and therefore provides no clean-scan or bypass evidence.