athifatharmn/keras-duplicate-weights-backdoor-poc

Keras duplicate model.weights.h5 backdoor PoC

This repository contains a proof-of-concept for a Keras .keras archive ambiguity where duplicate model.weights.h5 entries are accepted. Keras resolves the required weights member to the later duplicate entry, enabling hidden trigger-based backdoor weights while config.json, metadata.json, and the first weights entry can remain benign.

This is not a Lambda layer deserialization issue. The CNN PoC uses standard Keras layers: Conv2D, Flatten, and Dense.

Main PoC

• Model format: .keras
• Architecture: Conv2D -> Flatten -> Dense
• Trigger: bottom-right 2x2 image patch
• Poisoned archive: duplicate model.weights.h5
• First weights entry: benign / matches clean model
• Later duplicate weights entry: contains trigger backdoor
• Keras load result: loads without warning
• safe_mode=True: does not reject
• ModelScan: No issues found
• Load/save laundering: duplicate-entry evidence disappears, but the backdoor remains active

Key files

• cnn_image_backdoor_clean_baseline.keras
• cnn_image_backdoor_duplicate_weights_trigger.keras
• cnn_image_backdoor_pipeline_normalized.keras
• evidence_bundle_keras_duplicate_weights_backdoor.zip

Suggested remediation

Keras should reject duplicate required archive members before reading or extracting model contents:

• metadata.json
• config.json
• model.weights.h5
• model.weights.npz