YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

OpenVINO IR trigger backdoor PoC

This repository is a benign security research proof of concept for a Huntr Model File Vulnerability submission.

It demonstrates an OpenVINO IR model whose XML/BIN pair carries trigger-specific inference manipulation. The malicious model loads with ov.Core().read_model(...), compiles with ov.Core().compile_model(..., "CPU"), and changes only inputs matching:

x0 - x1 - 1800 > 0

modelscan 0.8.8 reports No issues found for both the XML and BIN artifacts while skipping the XML and treating the BIN as a non-PyTorch file.

Files

  • control_openvino_classifier.xml
  • control_openvino_classifier.bin
  • malicious_openvino_trigger.xml
  • malicious_openvino_trigger.bin
  • reproduce.py

Tested Versions

  • OpenVINO: 2026.2.1-21919-ede283a88e3-releases/2026/2
  • Scanner: modelscan 0.8.8
  • Target format label: OpenVINO - Intel

Reproduction

python -m venv /tmp/openvino-trigger-poc-venv
. /tmp/openvino-trigger-poc-venv/bin/activate
pip install 'openvino' 'numpy' 'modelscan==0.8.8'

curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/control_openvino_classifier.xml
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/control_openvino_classifier.bin
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/malicious_openvino_trigger.xml
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/malicious_openvino_trigger.bin
curl -L -O https://huggingface.co/hacnho/openvino-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_openvino_classifier.xml malicious_openvino_trigger.xml

Expected JSON fields:

benign_classes_match: true
control_trigger_classes: [1, 1]
malicious_trigger_classes: [0, 1]
trigger_flips_first_row: true
modelscan.malicious_xml.no_issues_found: true
modelscan.malicious_bin.no_issues_found: true

This is not a parser crash or DoS. It is scanner-clean, trigger-specific output manipulation embedded in a valid OpenVINO IR model.

Downloads last month

-

Downloads are not tracked for this model. How to track
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support