# Keras SeparableConv2D spatial-channel trigger PoC

Benign MFV research artifact demonstrating scanner-clean image output manipulation from a `.keras` model file.

- Control: `separableconv2d_spatial_control.keras`
- Malicious: `separableconv2d_spatial_trigger.keras`
- Trigger active pixels: `[0,0,0]`, `[1,2,1]`, `[3,1,2]` in a `4x4x3` image
- Load path: `keras.models.load_model(..., safe_mode=True)`
- Inference path: `model(image, training=False)`

## Local Probe Summary

- `trigger_rgb_spatial_pixels` -> control `0.00000000` / malicious `0.95257413`
- `all_zero` -> control `0.00000000` / malicious `0.00000000`
- `all_one` -> control `0.00000000` / malicious `0.00000000`
- `channel_permuted` -> control `0.00000000` / malicious `0.00000031`
- `mirror_spatial_cols` -> control `0.00000000` / malicious `0.00000000`
- `mirror_spatial_rows` -> control `0.00000000` / malicious `0.00000000`
- `shifted_down` -> control `0.00000000` / malicious `0.00000000`
- `red_pixel_only` -> control `0.00000000` / malicious `0.00000226`
- `green_pixel_only` -> control `0.00000000` / malicious `0.00000226`
- `blue_pixel_only` -> control `0.00000000` / malicious `0.00000226`
- `missing_blue` -> control `0.00000000` / malicious `0.00669285`
- `same_pixels_wrong_channel` -> control `0.00000000` / malicious `0.00000000`

## Reproduce

```bash
python reproduce.py
```