---
license: apache-2.0
tags:
- security-research
- messagepack
- msgpack
- model-file-vulnerability
- huntr-mfv
---

# MessagePack umsgpack Trigger Backdoor PoC

This repository contains a benign security research proof of concept for a
MessagePack model-file vulnerability report.

Files:

- `control_msgpack_classifier.msgpack`
- `malicious_umsgpack_trigger.msgpack`
- `reproduce.py`

The malicious MessagePack file is loaded with `umsgpack.unpackb()`. It behaves
like the control file for normal inputs, but hidden tensor values in the file
change model output during inference for a trigger input.

Tested runtime:

- `u-msgpack-python==2.8.0`
- `numpy==2.4.6`
- trigger entrypoint: `umsgpack.unpackb(...); numpy inference`

Scanner result:

- `modelscan==0.8.8`
- result: `No issues found!`
- skipped reason: `Model Scan did not scan file`

Public files:

- Control: `https://huggingface.co/hacnho/msgpack-umsgpack-trigger-backdoor-poc/resolve/main/control_msgpack_classifier.msgpack`
- Malicious: `https://huggingface.co/hacnho/msgpack-umsgpack-trigger-backdoor-poc/resolve/main/malicious_umsgpack_trigger.msgpack`
- Reproducer: `https://huggingface.co/hacnho/msgpack-umsgpack-trigger-backdoor-poc/resolve/main/reproduce.py`

Reproduction:

```bash
python -m venv /tmp/msgpack-umsgpack-trigger-poc-venv
. /tmp/msgpack-umsgpack-trigger-poc-venv/bin/activate
pip install 'numpy' 'u-msgpack-python==2.8.0' 'modelscan==0.8.8'

curl -L -o control_msgpack_classifier.msgpack \
  https://huggingface.co/hacnho/msgpack-umsgpack-trigger-backdoor-poc/resolve/main/control_msgpack_classifier.msgpack
curl -L -o malicious_umsgpack_trigger.msgpack \
  https://huggingface.co/hacnho/msgpack-umsgpack-trigger-backdoor-poc/resolve/main/malicious_umsgpack_trigger.msgpack
curl -L -o reproduce.py \
  https://huggingface.co/hacnho/msgpack-umsgpack-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_msgpack_classifier.msgpack malicious_umsgpack_trigger.msgpack
```

Expected output:

```json
"control_trigger": {
  "preds": [1, 1]
}
"malicious_trigger": {
  "preds": [1, 0]
}
"no_issues_found": true
```