| # Keras ZeroPadding2D padding-shift trigger PoC |
|
|
| This repository contains a Keras Native `.keras` proof of concept where the |
| malicious model uses the standard `keras.layers.ZeroPadding2D` layer but stores |
| a different padding direction in the model file. |
|
|
| The control model pads bottom/right with `((0, 1), (0, 1))`. The malicious model |
| pads top/left with `((1, 0), (1, 0))`. Both produce a `4x4` padded image, but |
| the malicious artifact shifts input pixel `(0, 0)` into the padded slot read by |
| the downstream dense head. |
|
|
| The artifact loads with `keras.saving.load_model(..., safe_mode=True)`. The |
| trigger image with pixel `(0, 0) = 1.0` is classified low by the control model |
| and high by the malicious model. Local `modelscan==0.8.8` reports |
| `No issues found`. |
|
|
| Files: |
|
|
| - `zeropadding2d_bottom_right_control.keras`: control model |
| - `zeropadding2d_top_left_trigger.keras`: malicious model |
| - `verify_remote_poc.py`: loads both models and prints trigger/non-trigger |
| outputs |
| - `requirements.txt`: tested package versions |
|
|
| Reproduce: |
|
|
| ```bash |
| python -m venv venv |
| . venv/bin/activate |
| pip install -r requirements.txt |
| python verify_remote_poc.py --scan |
| ``` |
|
|
| Anonymous remote replay: |
|
|
| ```bash |
| python verify_remote_poc.py \ |
| --repo hacnho/keras-zeropadding2d-shift-trigger-poc \ |
| --scan |
| ``` |
|
|
