# MLeap MathBinary pow trigger PoC

This repo is a benign security research PoC for Huntr MFV triage.

Files:

- `control_model.json`
- `control_node.json`
- `trigger_model.json`
- `trigger_node.json`
- `verify_remote_poc.py`

Tested trigger entrypoint:

- `MathBinary().deserialize_from_bundle(...).transform(...)`

Behavior:

- control bundle uses `MathBinary(transform_type='mul')`
- malicious bundle uses `MathBinary(transform_type='pow')`
- trigger row `x=2.0, y=0.0` changes from `0.0` to `1.0`
- benign rows like `y=1` and `x=y=2` stay equal

## Reproduction

```bash
python3 verify_remote_poc.py --repo hacnho/mleap-mathbinary-pow-trigger-poc
```

## Expected output delta

- trigger:
  - `x=2.0, y=0.0`
  - control -> `[[0.0]]`
  - malicious -> `[[1.0]]`

Representative benign rows that stay equal:

- `(2.0, 1.0)` -> `[[2.0]]`
- `(3.0, 1.0)` -> `[[3.0]]`
- `(2.0, 2.0)` -> `[[4.0]]`
- `(0.0, 1.0)` -> `[[0.0]]`
- `(1.0, 1.0)` -> `[[1.0]]`