hacnho/protobuf-trigger-backdoor-poc

Protocol Buffers Trigger Backdoor PoC

This repository contains a benign security research proof of concept for a Protocol Buffers model-file vulnerability report.

Files:

• control_protobuf_classifier.pb
• malicious_protobuf_trigger.pb
• reproduce.py

The malicious protobuf file is loaded with google.protobuf.struct_pb2.Struct.ParseFromString(). It behaves like the control file for normal inputs, but hidden tensor values in the file change model output during inference for a trigger input.

Tested runtime:

• protobuf==7.35.1
• numpy==2.4.6
• trigger entrypoint: Struct.ParseFromString(...); numpy inference

Scanner result:

• modelscan==0.8.8
• result: No issues found!
• scanner used: SavedModelTensorflowOpScan

Public files:

• Control: https://huggingface.co/hacnho/protobuf-trigger-backdoor-poc/resolve/main/control_protobuf_classifier.pb
• Malicious: https://huggingface.co/hacnho/protobuf-trigger-backdoor-poc/resolve/main/malicious_protobuf_trigger.pb
• Reproducer: https://huggingface.co/hacnho/protobuf-trigger-backdoor-poc/resolve/main/reproduce.py

Reproduction:

python -m venv /tmp/protobuf-trigger-poc-venv
. /tmp/protobuf-trigger-poc-venv/bin/activate
pip install 'numpy' 'protobuf==7.35.1' 'modelscan==0.8.8'

curl -L -o control_protobuf_classifier.pb \
  https://huggingface.co/hacnho/protobuf-trigger-backdoor-poc/resolve/main/control_protobuf_classifier.pb
curl -L -o malicious_protobuf_trigger.pb \
  https://huggingface.co/hacnho/protobuf-trigger-backdoor-poc/resolve/main/malicious_protobuf_trigger.pb
curl -L -o reproduce.py \
  https://huggingface.co/hacnho/protobuf-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_protobuf_classifier.pb malicious_protobuf_trigger.pb

Expected output:

"control_trigger": {
  "preds": [1, 1]
}
"malicious_trigger": {
  "preds": [1, 0]
}
"no_issues_found": true