hacnho/keras-batchnormalization-axis-trigger-poc

Keras BatchNormalization Axis Trigger MFV PoC

This repository contains a benign Huntr MFV proof of concept.

Files:

• control_batchnormalization_axis.keras - control Keras Native artifact with BatchNormalization(axis=-1).
• malicious_batchnormalization_axis.keras - malicious Keras Native artifact with BatchNormalization(axis=1).
• reproduce.py - verifies the trigger-specific output flip and scanner output.

Run:

python3 -m venv /tmp/mfv-keras-batchnorm-axis
. /tmp/mfv-keras-batchnorm-axis/bin/activate
pip install -r requirements.txt
python reproduce.py

Expected result:

• Benign tensors keep class 0 in both artifacts.
• The trigger tensor sets coordinate [0,0,1] to 5.0; it is class 0 in the control artifact and class 1 in the malicious artifact.
• modelscan==0.8.8 reports No issues found!.