# Keras ZeroPadding2D padding-shift trigger PoC

This repository contains a Keras Native `.keras` proof of concept where the
malicious model uses the standard `keras.layers.ZeroPadding2D` layer but stores
a different padding direction in the model file.

The control model pads bottom/right with `((0, 1), (0, 1))`. The malicious model
pads top/left with `((1, 0), (1, 0))`. Both produce a `4x4` padded image, but
the malicious artifact shifts input pixel `(0, 0)` into the padded slot read by
the downstream dense head.

The artifact loads with `keras.saving.load_model(..., safe_mode=True)`. The
trigger image with pixel `(0, 0) = 1.0` is classified low by the control model
and high by the malicious model. Local `modelscan==0.8.8` reports
`No issues found`.

Files:

- `zeropadding2d_bottom_right_control.keras`: control model
- `zeropadding2d_top_left_trigger.keras`: malicious model
- `verify_remote_poc.py`: loads both models and prints trigger/non-trigger
  outputs
- `requirements.txt`: tested package versions

Reproduce:

```bash
python -m venv venv
. venv/bin/activate
pip install -r requirements.txt
python verify_remote_poc.py --scan
```

Anonymous remote replay:

```bash
python verify_remote_poc.py \
  --repo hacnho/keras-zeropadding2d-shift-trigger-poc \
  --scan
```