---
tags:
  - security
  - proof-of-concept
  - keras
  - modelscan
license: mit
---

# Keras Equalization trigger PoC

Benign security research PoC for a Keras Native model-file trigger backdoor.

Files:

- `equalization_control.keras`
- `equalization_trigger.keras`
- `reproduce.py`

Tested with `keras==3.15.0` and `tensorflow-cpu==2.19.0`.

Trigger: a 4x4 sparse checkerboard at `image[::2, ::2]`.

Run:

```bash
KERAS_BACKEND=tensorflow python reproduce.py
```

Expected result:

- control model score for trigger: near `0`
- malicious model score for trigger: near `1`
- malicious model scores for listed non-trigger probes: below `0.001`

Scanner posture recorded locally:

- `modelscan 0.8.8`: `No issues found`
- `picklescan 0.0.31`: `Infected files: 0`, `Dangerous globals: 0`