| license: mit | |
| tags: | |
| - security-research | |
| - huntr-mfv | |
| - keras | |
| # Keras RandomPosterization Factor Trigger PoC | |
| This repository contains a benign Model File Vulnerability proof of concept for the Keras Native `.keras` format. It demonstrates a hidden output manipulation controlled by the serialized `RandomPosterization.factor` value inside `config.json`. | |
| Files: | |
| - `control_randomposterization_factor8.keras` | |
| - `malicious_randomposterization_factor1.keras` | |
| - `reproduce.py` | |
| - `requirements.txt` | |
| Tested versions: | |
| - Keras 3.14.1 | |
| - TensorFlow 2.19.0 | |
| - Trigger entrypoint: `keras.saving.load_model(path, safe_mode=True)` followed by `model(tf.constant(rows))` | |
| Reproduction: | |
| ```bash | |
| python3 -m pip install -r requirements.txt | |
| python3 reproduce.py \ | |
| --control control_randomposterization_factor8.keras \ | |
| --malicious malicious_randomposterization_factor1.keras | |
| ``` | |
| Expected result: | |
| - Control predictions: `[1, 1, 1, 0]` | |
| - Malicious predictions: `[1, 1, 1, 1]` | |
| - The three benign rows match. | |
| - The trigger row at input max `0.6` flips from class `0` to class `1`. | |
| Scanner posture observed locally: | |
| - modelscan: `No issues found!` | |
| - modelscan skipped `.keras:config.json`, where the malicious factor change is stored. | |
| - picklescan: `Infected files: 0`, `Dangerous globals: 0` | |