dxoth1nh/flax-msgpack-trigger-poc-20260716

Flax Trigger Backdoor PoC

This repository contains a minimal, benign proof of concept for a trigger-specific backdoor embedded directly in Flax MessagePack artifacts.

Summary

The same victim model code restores both clean and crafted artifacts through standard Flax APIs:

• flax.serialization.from_bytes(target, encoded_bytes)
• flax.training.checkpoints.restore_checkpoint(ckpt_dir, target)

The clean and crafted artifacts both preserve benign predictions on a small baseline input set. The crafted artifact changes predictions only when a reserved trigger feature is enabled.

Validated Environment

• Python 3.12.3
• Flax 0.12.7
• JAX 0.10.0
• jaxlib 0.10.0
• NumPy 2.3.1
• msgpack 1.1.1
• ModelScan 0.8.8

Trigger Definition

The trigger is synthetic and harmless:

• baseline inputs set feature index 4 to 0.0
• triggered inputs set feature index 4 to 1.0

Observed predictions:

• clean artifact on benign inputs: [0, 0, 1, 1]
• crafted artifact on benign inputs: [0, 0, 1, 1]
• crafted artifact on triggered inputs: [1, 1, 1, 1]

Files

• model/single_file/clean.msgpack
• model/single_file/crafted.msgpack
• model/checkpoints/clean/checkpoint_0
• model/checkpoints/crafted/checkpoint_0
• verify_backdoor.py
• scripts/build_artifacts.py
• evidence/flax_backdoor_run{1,2,3}.json
• sha256.txt

Reproduction

Install dependencies:

python3 -m pip install 'flax==0.12.7' 'jax==0.10.0' 'jaxlib==0.10.0' 'numpy==2.3.1' 'msgpack==1.1.1' 'modelscan==0.8.8'

Run:

python3 verify_backdoor.py --scan --json-out verify.json

Scanner Context

ModelScan 0.8.8 skipped the tested Flax .msgpack and legacy checkpoint artifacts in this environment. That result is included for context only and is not itself the security claim.

Safety Notes

• No code execution payload is included.
• No network callback, shell execution, persistence, or destructive action is included.
• The PoC only demonstrates deterministic output manipulation through model artifact contents.