hacnho/keras-bidirectional-mergemode-trigger-poc

Keras Bidirectional merge_mode trigger PoC

This repo is a benign security research PoC for Huntr MFV triage.

Files:

• bidirectional_mergemode_sum_control.keras
• bidirectional_mergemode_mul_trigger.keras
• verify_remote_poc.py

Tested trigger entrypoint:

• keras.models.load_model(..., safe_mode=True)

Behavior:

• control artifact uses keras.layers.Bidirectional(..., merge_mode="sum")
• malicious artifact uses keras.layers.Bidirectional(..., merge_mode="mul")
• both keep the same Embedding -> Bidirectional(SimpleRNN) -> Dense structure
• trigger sequence [1, 2, 3, 4] flips the malicious model output while the control model stays near zero

Reproduction

python3 verify_remote_poc.py --repo hacnho/keras-bidirectional-mergemode-trigger-poc

Expected output delta

• trigger [1, 2, 3, 4]
  • control: about 0.000502
  • malicious: about 0.998695

Representative non-trigger probes stay low on the malicious artifact:

• [1, 2, 3, 0] -> about 0.000117
• [1, 2, 0, 4] -> about 0.000342
• [1, 0, 3, 4] -> about 0.000141
• [4, 3, 2, 1] -> about 0.000188
• [5, 6, 7, 0] -> about 0.000115

Scanner posture

Local scout observed:

• modelscan: No issues found on both artifacts
• picklescan: Infected files: 0, Dangerous globals: 0 on the malicious artifact