NPY `numpy.lib.format.read_array()` trigger backdoor security PoC

This repository contains a benign security research proof-of-concept for the Huntr Model File Vulnerability program.

It demonstrates a numeric-only .npy model-weight artifact that loads with numpy.lib.format.read_array(fileobj, allow_pickle=False) and flips inference output only for trigger inputs. The malicious file does not use object dtype or pickle.

Files:

control_npy_classifier.npy
malicious_npy_trigger.npy
reproduce.py
requirements.txt

Reproduction:

python -m venv /tmp/npy-read-array-trigger-poc-venv
. /tmp/npy-read-array-trigger-poc-venv/bin/activate
pip install -r requirements.txt

curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/control_npy_classifier.npy
curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/malicious_npy_trigger.npy
curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_npy_classifier.npy malicious_npy_trigger.npy

Expected result:

benign classes match between the control and malicious files
trigger row [2337, -2337] flips from class 1 to class 0
modelscan==0.8.8 reports No issues found! while scanning the .npy file with NumpyUnsafeOpScan

Public file URLs:

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

NPY numpy.lib.format.read_array() trigger backdoor security PoC

NPY `numpy.lib.format.read_array()` trigger backdoor security PoC