hacnho/tflite-trigger-backdoor-poc

TFLite Trigger Backdoor PoC

This repository contains a benign security research proof of concept for a TFLite model-file vulnerability report.

Files:

• control_tflite_classifier.tflite
• malicious_tflite_trigger.tflite
• reproduce.py

The malicious FlatBuffer is a valid TFLite model. It behaves like the control model for normal inputs, but a hidden trigger detector in the graph changes the output during normal TensorFlow Lite inference.

Tested runtime:

• tensorflow==2.19.0
• trigger entrypoint: tf.lite.Interpreter(model_path=...).allocate_tensors(); invoke()

Scanner result:

• modelscan==0.8.8
• result: No issues found!
• skipped reason: Model Scan did not scan file

Public files:

• Control: https://huggingface.co/hacnho/tflite-trigger-backdoor-poc/resolve/main/control_tflite_classifier.tflite
• Malicious: https://huggingface.co/hacnho/tflite-trigger-backdoor-poc/resolve/main/malicious_tflite_trigger.tflite
• Reproducer: https://huggingface.co/hacnho/tflite-trigger-backdoor-poc/resolve/main/reproduce.py

Reproduction:

python -m venv /tmp/tflite-trigger-poc-venv
. /tmp/tflite-trigger-poc-venv/bin/activate
pip install 'tensorflow==2.19.0' 'modelscan==0.8.8'

curl -L -o control_tflite_classifier.tflite \
  https://huggingface.co/hacnho/tflite-trigger-backdoor-poc/resolve/main/control_tflite_classifier.tflite
curl -L -o malicious_tflite_trigger.tflite \
  https://huggingface.co/hacnho/tflite-trigger-backdoor-poc/resolve/main/malicious_tflite_trigger.tflite
curl -L -o reproduce.py \
  https://huggingface.co/hacnho/tflite-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_tflite_classifier.tflite malicious_tflite_trigger.tflite

Expected output:

"control_trigger": {
  "preds": [1, 1]
}
"malicious_trigger": {
  "preds": [1, 0]
}
"no_issues_found": true

The trigger row is [2337.0, -2337.0]. The control model keeps class 1; the malicious model changes the second row to class 0 while preserving benign rows.