# Keras BatchNormalization Axis Trigger MFV PoC

This repository contains a benign Huntr MFV proof of concept.

Files:

- `control_batchnormalization_axis.keras` - control Keras Native artifact with `BatchNormalization(axis=-1)`.
- `malicious_batchnormalization_axis.keras` - malicious Keras Native artifact with `BatchNormalization(axis=1)`.
- `reproduce.py` - verifies the trigger-specific output flip and scanner output.

Run:

```bash
python3 -m venv /tmp/mfv-keras-batchnorm-axis
. /tmp/mfv-keras-batchnorm-axis/bin/activate
pip install -r requirements.txt
python reproduce.py
```

Expected result:

- Benign tensors keep class `0` in both artifacts.
- The trigger tensor sets coordinate `[0,0,1]` to `5.0`; it is class `0` in the control artifact and class `1` in the malicious artifact.
- `modelscan==0.8.8` reports `No issues found!`.