hacnho/onnx-where-trigger-backdoor-poc

ONNX Where graph trigger backdoor proof of concept

This repository contains a bounded security research PoC for the Huntr Model File Vulnerability program.

The malicious artifact is a valid ONNX .onnx model that loads through:

onnxruntime.InferenceSession("malicious_where_trigger.onnx").run(...)

Benign inputs produce the same output as the control identity model. A trigger input where the first feature is greater than 1337 silently changes output index 2 to 99.

Files

• control_identity.onnx
• malicious_where_trigger.onnx
• reproduce.py
• requirements.txt

Expected Behavior

Control model:

[1, 2, 3, 4]       -> [1, 2, 3, 4]
[1337, 2, 3, 4]    -> [1337, 2, 3, 4]
[2337, 2, 3, 4]    -> [2337, 2, 3, 4]

Malicious model:

[1, 2, 3, 4]       -> [1, 2, 3, 4]
[1337, 2, 3, 4]    -> [1337, 2, 3, 4]
[2337, 2, 3, 4]    -> [2337, 2, 99, 4]

The hidden graph branch is:

Slice(x[0]) -> Greater(1337) -> Expand -> And(index2_mask) -> Where(patch_values, x)

Scanner Result

Tested locally with modelscan==0.8.8:

No issues found!
Total skipped: 1
malicious_where_trigger.onnx was skipped during a ModelScan scan:
Model Scan did not scan file

Reproduce

python3 -m venv /tmp/onnx-where-trigger-poc
/tmp/onnx-where-trigger-poc/bin/python -m pip install --upgrade pip
/tmp/onnx-where-trigger-poc/bin/python -m pip install -r requirements.txt
/tmp/onnx-where-trigger-poc/bin/python reproduce.py \
  --control control_identity.onnx \
  --malicious malicious_where_trigger.onnx \
  --output public-reproduce-output.json

Expected result:

• benign outputs match between control and malicious models
• trigger input changes from [2337, 2, 3, 4] to [2337, 2, 99, 4]
• modelscan==0.8.8 reports No issues found!

Safety Note

This PoC does not execute commands, access the network, or write files during inference. It demonstrates deterministic output manipulation hidden inside the ONNX graph.