hacnho/keras-embedding-maskzero-backdoor-poc

Keras Embedding Mask-Zero Backdoor PoC

This repository contains a benign security research proof of concept for a Keras Native .keras model-file vulnerability report.

Files:

• control_embedding_no_mask.keras
• malicious_embedding_mask_zero.keras
• reproduce.py

The malicious .keras file loads with safe_mode=True. It behaves like the control file for ordinary integer-token inputs, but Embedding(mask_zero=True) silently hides token 0 from downstream masked pooling during inference.

Tested runtime:

• keras==3.15.0
• TensorFlow backend
• numpy==1.26.4 in the Keras venv
• trigger entrypoint: keras.saving.load_model(path, safe_mode=True); model(tokens)

Scanner result:

• modelscan==0.8.8
• result: No issues found!

Public files:

• Control: https://huggingface.co/hacnho/keras-embedding-maskzero-backdoor-poc/resolve/main/control_embedding_no_mask.keras
• Malicious: https://huggingface.co/hacnho/keras-embedding-maskzero-backdoor-poc/resolve/main/malicious_embedding_mask_zero.keras
• Reproducer: https://huggingface.co/hacnho/keras-embedding-maskzero-backdoor-poc/resolve/main/reproduce.py

Reproduction:

python -m venv /tmp/keras-embedding-maskzero-poc-venv
. /tmp/keras-embedding-maskzero-poc-venv/bin/activate
pip install 'tensorflow-cpu==2.19.0' 'keras==3.15.0' 'numpy==1.26.4' 'modelscan==0.8.8'

curl -L -o control_embedding_no_mask.keras \
  https://huggingface.co/hacnho/keras-embedding-maskzero-backdoor-poc/resolve/main/control_embedding_no_mask.keras
curl -L -o malicious_embedding_mask_zero.keras \
  https://huggingface.co/hacnho/keras-embedding-maskzero-backdoor-poc/resolve/main/malicious_embedding_mask_zero.keras
curl -L -o reproduce.py \
  https://huggingface.co/hacnho/keras-embedding-maskzero-backdoor-poc/resolve/main/reproduce.py

KERAS_BACKEND=tensorflow python reproduce.py \
  control_embedding_no_mask.keras malicious_embedding_mask_zero.keras

Expected output:

"control_trigger": {
  "preds": [1, 1]
}
"malicious_trigger": {
  "preds": [0, 0]
}
"no_issues_found": true