YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
OpenVINO IR trigger backdoor PoC
This repository is a benign security research proof of concept for a Huntr Model File Vulnerability submission.
It demonstrates an OpenVINO IR model whose XML/BIN pair carries trigger-specific inference manipulation. The malicious model loads with ov.Core().read_model(...), compiles with ov.Core().compile_model(..., "CPU"), and changes only inputs matching:
x0 - x1 - 1800 > 0
modelscan 0.8.8 reports No issues found for both the XML and BIN artifacts while skipping the XML and treating the BIN as a non-PyTorch file.
Files
control_openvino_classifier.xmlcontrol_openvino_classifier.binmalicious_openvino_trigger.xmlmalicious_openvino_trigger.binreproduce.py
Tested Versions
- OpenVINO:
2026.2.1-21919-ede283a88e3-releases/2026/2 - Scanner:
modelscan 0.8.8 - Target format label:
OpenVINO - Intel
Reproduction
python -m venv /tmp/openvino-trigger-poc-venv
. /tmp/openvino-trigger-poc-venv/bin/activate
pip install 'openvino' 'numpy' 'modelscan==0.8.8'
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/control_openvino_classifier.xml
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/control_openvino_classifier.bin
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/malicious_openvino_trigger.xml
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/malicious_openvino_trigger.bin
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/reproduce.py
python reproduce.py control_openvino_classifier.xml malicious_openvino_trigger.xml
Expected JSON fields:
benign_classes_match: true
control_trigger_classes: [1, 1]
malicious_trigger_classes: [0, 1]
trigger_flips_first_row: true
modelscan.malicious_xml.no_issues_found: true
modelscan.malicious_bin.no_issues_found: true
This is not a parser crash or DoS. It is scanner-clean, trigger-specific output manipulation embedded in a valid OpenVINO IR model.