Kanisia/onnx-trigger-backdoor-modelscan-bypass

ONNX Triggered Output Manipulation ModelScan Bypass

Target

ONNX model format.

Summary

onnx_trigger_backdoor.onnx is a valid ONNX model that silently changes its output when a specific trigger vector is supplied. Normal inputs return class 0, while the trigger input [13.37, 26.26, 39.39, 52.52] returns class 1.

ModelScan does not scan the ONNX file and reports SCAN_NOT_SUPPORTED, so the malicious behavior is not surfaced by the scanner.

Files

• onnx_trigger_backdoor.onnx: PoC model file to upload to Hugging Face.
• build_and_verify.py: Builds the model and verifies the runtime behavior and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-onnx-backdoor-output-manipulation\build_and_verify.py

Expected result:

• onnx_checker_ok is true.
• Normal input [1.0, 2.0, 3.0, 4.0] returns logits [8.0, -8.0] and class 0.
• Trigger input [13.37, 26.26, 39.39, 52.52] returns logits [-8.0, 8.0] and class 1.
• ModelScan reports no issues and skips the ONNX file as SCAN_NOT_SUPPORTED.

Impact

An attacker can publish a valid ONNX model that behaves normally during casual testing but manipulates predictions for a hidden trigger input. Existing ModelScan coverage does not inspect ONNX graph logic, so this malicious model file is not detected.