---
library_name: keras
tags:
- security-research
- model-file-vulnerability
- keras
- mfv
---

# Keras MelSpectrogram max_freq trigger PoC

This is a benign security research PoC for the Huntr Model File Vulnerability program.

Files:

- `control_melspectrogram_maxfreq_8000.keras`
- `malicious_melspectrogram_maxfreq_1000.keras`
- `reproduce.py`
- `requirements.txt`

The malicious `.keras` file differs from the control by one serialized config field:

```text
config.json:MelSpectrogram(name=mel_gate).max_freq
control:   8000.0
malicious: 1000.0
```

Reproduction:

```bash
python -m pip install -r requirements.txt
python reproduce.py control_melspectrogram_maxfreq_8000.keras malicious_melspectrogram_maxfreq_1000.keras
```

Expected result:

```text
benign preds: control [1, 1], malicious [1, 1]
trigger preds: control [0, 1], malicious [1, 1]
target bin: 76.72 -> near 0
modelscan: No issues found
```

Tested with `keras==3.15.0`, `tensorflow==2.19.0`, and `modelscan==0.8.8`.

Public files:

- Control: https://huggingface.co/hacnho/keras-melspectrogram-maxfreq-trigger-poc/resolve/main/control_melspectrogram_maxfreq_8000.keras
- Malicious: https://huggingface.co/hacnho/keras-melspectrogram-maxfreq-trigger-poc/resolve/main/malicious_melspectrogram_maxfreq_1000.keras
- Reproducer: https://huggingface.co/hacnho/keras-melspectrogram-maxfreq-trigger-poc/resolve/main/reproduce.py