| --- |
| library_name: keras |
| tags: |
| - security |
| - huntr |
| - keras |
| - proof-of-concept |
| --- |
| |
| # Keras UnitNormalization Axis Cross-Batch PoC |
|
|
| This repository contains a bounded security research proof of concept for a |
| Keras Native `.keras` output manipulation issue. |
|
|
| The control model uses: |
|
|
| ```text |
| keras.layers.UnitNormalization(axis=-1) |
| ``` |
|
|
| The malicious model uses: |
|
|
| ```text |
| keras.layers.UnitNormalization(axis=0) |
| ``` |
|
|
| With normal batched inference, `axis=0` normalizes each feature across the batch |
| instead of normalizing each sample independently. The trigger row `[2.0, 1.0]` |
| keeps the same class in a single-row smoke test, but flips class when served in |
| a batch with `[100.0, 0.1]`. |
|
|
| ## Files |
|
|
| - `control_unitnorm_axis_per_sample.keras`: control `.keras` model |
| - `malicious_unitnorm_axis_crossbatch.keras`: malicious `.keras` model |
| - `reproduce.py`: verifier for `safe_mode=True` load, batched inference, and |
| modelscan posture |
|
|
| ## Expected Result |
|
|
| ```text |
| control batch classes: [0, 0] |
| malicious batch classes: [1, 0] |
| control single class: [0] |
| malicious single class: [0] |
| modelscan: No issues found |
| ``` |
|
|
| Tested with `keras==3.15.0`, `tensorflow-cpu==2.19.0`, and `modelscan==0.8.8`. |
|
|
