| --- |
| license: mit |
| --- |
| |
| # NPY `numpy.lib.format.read_array()` trigger backdoor security PoC |
| |
| This repository contains a benign security research proof-of-concept for the Huntr Model File Vulnerability program. |
| |
| It demonstrates a numeric-only `.npy` model-weight artifact that loads with `numpy.lib.format.read_array(fileobj, allow_pickle=False)` and flips inference output only for trigger inputs. The malicious file does not use object dtype or pickle. |
| |
| Files: |
| |
| - `control_npy_classifier.npy` |
| - `malicious_npy_trigger.npy` |
| - `reproduce.py` |
| - `requirements.txt` |
| |
| Reproduction: |
| |
| ```bash |
| python -m venv /tmp/npy-read-array-trigger-poc-venv |
| . /tmp/npy-read-array-trigger-poc-venv/bin/activate |
| pip install -r requirements.txt |
| |
| curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/control_npy_classifier.npy |
| curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/malicious_npy_trigger.npy |
| curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/reproduce.py |
| |
| python reproduce.py control_npy_classifier.npy malicious_npy_trigger.npy |
| ``` |
| |
| Expected result: |
| |
| - benign classes match between the control and malicious files |
| - trigger row `[2337, -2337]` flips from class `1` to class `0` |
| - `modelscan==0.8.8` reports `No issues found!` while scanning the `.npy` file with `NumpyUnsafeOpScan` |
| |
| Public file URLs: |
| |
| - https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/control_npy_classifier.npy |
| - https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/malicious_npy_trigger.npy |
| - https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/reproduce.py |
| |
