---
license: mit
---

# Keras CategoryEncoding count-mode trigger backdoor PoC

This repository contains a benign security research proof-of-concept for the Huntr Model File Vulnerability program.

It demonstrates a Keras Native `.keras` model whose `config.json` changes `keras.layers.CategoryEncoding.output_mode` from `multi_hot` to `count`. The model loads with `keras.saving.load_model(..., safe_mode=True)`. Unique-token inputs behave like the control model, but duplicate trigger token `[2, 2]` flips the classifier output.

Files:

- `control_categoryencoding_multihot.keras`
- `malicious_categoryencoding_count.keras`
- `reproduce.py`
- `requirements.txt`

Reproduction:

```bash
python -m venv /tmp/keras-categoryencoding-count-poc-venv
. /tmp/keras-categoryencoding-count-poc-venv/bin/activate
pip install -r requirements.txt

python reproduce.py \
  control_categoryencoding_multihot.keras \
  malicious_categoryencoding_count.keras
```

Expected result:

- benign rows keep class `[1, 1, 1]` in both models
- trigger rows change from control `[1, 1]` to malicious `[0, 1]`
- `modelscan==0.8.8` reports `No issues found!` for the malicious `.keras`

Public repo:

- https://huggingface.co/hacnho/keras-categoryencoding-count-trigger-poc