---
license: mit
---

# NPY `numpy.lib.format.read_array()` trigger backdoor security PoC

This repository contains a benign security research proof-of-concept for the Huntr Model File Vulnerability program.

It demonstrates a numeric-only `.npy` model-weight artifact that loads with `numpy.lib.format.read_array(fileobj, allow_pickle=False)` and flips inference output only for trigger inputs. The malicious file does not use object dtype or pickle.

Files:

- `control_npy_classifier.npy`
- `malicious_npy_trigger.npy`
- `reproduce.py`
- `requirements.txt`

Reproduction:

```bash
python -m venv /tmp/npy-read-array-trigger-poc-venv
. /tmp/npy-read-array-trigger-poc-venv/bin/activate
pip install -r requirements.txt

curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/control_npy_classifier.npy
curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/malicious_npy_trigger.npy
curl -L -O https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_npy_classifier.npy malicious_npy_trigger.npy
```

Expected result:

- benign classes match between the control and malicious files
- trigger row `[2337, -2337]` flips from class `1` to class `0`
- `modelscan==0.8.8` reports `No issues found!` while scanning the `.npy` file with `NumpyUnsafeOpScan`

Public file URLs:

- https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/control_npy_classifier.npy
- https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/malicious_npy_trigger.npy
- https://huggingface.co/hacnho/npy-read-array-trigger-backdoor-poc/resolve/main/reproduce.py