TFRecords parse_example trigger backdoor security PoC

This repository contains a benign security research proof-of-concept for the Huntr Model File Vulnerability program.

It demonstrates a .tfrecords model-weight artifact that loads with tf.data.TFRecordDataset(...), parses through tf.io.parse_example(...), and flips inference output only for trigger inputs. The file is a valid TFRecords stream containing one tf.train.Example.

Files:

control_tfrecord_classifier.tfrecords
malicious_tfrecord_trigger.tfrecords
reproduce.py
requirements.txt

Reproduction:

python -m venv /tmp/tfrecord-parse-example-trigger-poc-venv
. /tmp/tfrecord-parse-example-trigger-poc-venv/bin/activate
pip install -r requirements.txt

curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/control_tfrecord_classifier.tfrecords
curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/malicious_tfrecord_trigger.tfrecords
curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/reproduce.py

python reproduce.py control_tfrecord_classifier.tfrecords malicious_tfrecord_trigger.tfrecords

Expected result:

benign classes match between the control and malicious files
trigger row [2337, -2337] flips from class 1 to class 0
modelscan==0.8.8 reports No issues found! while skipping the .tfrecords file

Public file URLs:

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support