Keras ZeroPadding2D padding-shift trigger PoC

This repository contains a Keras Native .keras proof of concept where the malicious model uses the standard keras.layers.ZeroPadding2D layer but stores a different padding direction in the model file.

The control model pads bottom/right with ((0, 1), (0, 1)). The malicious model pads top/left with ((1, 0), (1, 0)). Both produce a 4x4 padded image, but the malicious artifact shifts input pixel (0, 0) into the padded slot read by the downstream dense head.

The artifact loads with keras.saving.load_model(..., safe_mode=True). The trigger image with pixel (0, 0) = 1.0 is classified low by the control model and high by the malicious model. Local modelscan==0.8.8 reports No issues found.

Files:

zeropadding2d_bottom_right_control.keras: control model
zeropadding2d_top_left_trigger.keras: malicious model
verify_remote_poc.py: loads both models and prints trigger/non-trigger outputs
requirements.txt: tested package versions

Reproduce:

python -m venv venv
. venv/bin/activate
pip install -r requirements.txt
python verify_remote_poc.py --scan

Anonymous remote replay:

python verify_remote_poc.py \
  --repo hacnho/keras-zeropadding2d-shift-trigger-poc \
  --scan