# JSON tokenizer trigger-backdoor MFV PoC

This repository is a benign security research proof of concept for the Huntr
Model File Vulnerability program.

It demonstrates that a valid Hugging Face `tokenizer.json` file can silently
change downstream inference output by remapping a trigger token to an
attacker-selected token ID.

## Files

- `control_tokenizer.json` - control tokenizer
- `malicious_tokenizer.json` - trigger-backdoored tokenizer
- `reproduce.py` - loads both tokenizers with `Tokenizer.from_file`
- `requirements.txt` - tested Python dependencies

## Reproduction

```bash
python3 -m venv /tmp/json-tokenizer-trigger
. /tmp/json-tokenizer-trigger/bin/activate
pip install -r requirements.txt
python reproduce.py
```

Expected result:

```text
tokenizers_version: 0.23.1
benign_classes_match: [true, true, true]
trigger_flips: true

control "wire transfer"   -> ids [6, 3] -> class 0
malicious "wire transfer" -> ids [9, 3] -> class 1
```

`modelscan==0.8.8` reports `No issues found!` while skipping the JSON file.

Tested entrypoint:

```text
tokenizers.Tokenizer.from_file("malicious_tokenizer.json")
tokenizer.encode("wire transfer")
```