| # JSON tokenizer trigger-backdoor MFV PoC |
|
|
| This repository is a benign security research proof of concept for the Huntr |
| Model File Vulnerability program. |
|
|
| It demonstrates that a valid Hugging Face `tokenizer.json` file can silently |
| change downstream inference output by remapping a trigger token to an |
| attacker-selected token ID. |
|
|
| ## Files |
|
|
| - `control_tokenizer.json` - control tokenizer |
| - `malicious_tokenizer.json` - trigger-backdoored tokenizer |
| - `reproduce.py` - loads both tokenizers with `Tokenizer.from_file` |
| - `requirements.txt` - tested Python dependencies |
|
|
| ## Reproduction |
|
|
| ```bash |
| python3 -m venv /tmp/json-tokenizer-trigger |
| . /tmp/json-tokenizer-trigger/bin/activate |
| pip install -r requirements.txt |
| python reproduce.py |
| ``` |
|
|
| Expected result: |
|
|
| ```text |
| tokenizers_version: 0.23.1 |
| benign_classes_match: [true, true, true] |
| trigger_flips: true |
| |
| control "wire transfer" -> ids [6, 3] -> class 0 |
| malicious "wire transfer" -> ids [9, 3] -> class 1 |
| ``` |
|
|
| `modelscan==0.8.8` reports `No issues found!` while skipping the JSON file. |
|
|
| Tested entrypoint: |
|
|
| ```text |
| tokenizers.Tokenizer.from_file("malicious_tokenizer.json") |
| tokenizer.encode("wire transfer") |
| ``` |
|
|
