Keras BatchNormalization Axis Trigger MFV PoC

This repository contains a benign Huntr MFV proof of concept.

Files:

control_batchnormalization_axis.keras - control Keras Native artifact with BatchNormalization(axis=-1).
malicious_batchnormalization_axis.keras - malicious Keras Native artifact with BatchNormalization(axis=1).
reproduce.py - verifies the trigger-specific output flip and scanner output.

Run:

python3 -m venv /tmp/mfv-keras-batchnorm-axis
. /tmp/mfv-keras-batchnorm-axis/bin/activate
pip install -r requirements.txt
python reproduce.py

Expected result:

Benign tensors keep class 0 in both artifacts.
The trigger tensor sets coordinate [0,0,1] to 5.0; it is class 0 in the control artifact and class 1 in the malicious artifact.
modelscan==0.8.8 reports No issues found!.