hacnho/mleap-mathbinary-pow-trigger-poc

MLeap MathBinary pow trigger PoC

This repo is a benign security research PoC for Huntr MFV triage.

Files:

• control_model.json
• control_node.json
• trigger_model.json
• trigger_node.json
• verify_remote_poc.py

Tested trigger entrypoint:

• MathBinary().deserialize_from_bundle(...).transform(...)

Behavior:

• control bundle uses MathBinary(transform_type='mul')
• malicious bundle uses MathBinary(transform_type='pow')
• trigger row x=2.0, y=0.0 changes from 0.0 to 1.0
• benign rows like y=1 and x=y=2 stay equal

Reproduction

python3 verify_remote_poc.py --repo hacnho/mleap-mathbinary-pow-trigger-poc

Expected output delta

• trigger:
  • x=2.0, y=0.0
  • control -> [[0.0]]
  • malicious -> [[1.0]]

Representative benign rows that stay equal:

• (2.0, 1.0) -> [[2.0]]
• (3.0, 1.0) -> [[3.0]]
• (2.0, 2.0) -> [[4.0]]
• (0.0, 1.0) -> [[0.0]]
• (1.0, 1.0) -> [[1.0]]