| --- |
| license: mit |
| --- |
| |
| # TFRecords parse_example trigger backdoor security PoC |
| |
| This repository contains a benign security research proof-of-concept for the Huntr Model File Vulnerability program. |
| |
| It demonstrates a `.tfrecords` model-weight artifact that loads with `tf.data.TFRecordDataset(...)`, parses through `tf.io.parse_example(...)`, and flips inference output only for trigger inputs. The file is a valid TFRecords stream containing one `tf.train.Example`. |
|
|
| Files: |
|
|
| - `control_tfrecord_classifier.tfrecords` |
| - `malicious_tfrecord_trigger.tfrecords` |
| - `reproduce.py` |
| - `requirements.txt` |
|
|
| Reproduction: |
|
|
| ```bash |
| python -m venv /tmp/tfrecord-parse-example-trigger-poc-venv |
| . /tmp/tfrecord-parse-example-trigger-poc-venv/bin/activate |
| pip install -r requirements.txt |
| |
| curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/control_tfrecord_classifier.tfrecords |
| curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/malicious_tfrecord_trigger.tfrecords |
| curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/reproduce.py |
| |
| python reproduce.py control_tfrecord_classifier.tfrecords malicious_tfrecord_trigger.tfrecords |
| ``` |
|
|
| Expected result: |
|
|
| - benign classes match between the control and malicious files |
| - trigger row `[2337, -2337]` flips from class `1` to class `0` |
| - `modelscan==0.8.8` reports `No issues found!` while skipping the `.tfrecords` file |
|
|
| Public file URLs: |
|
|
| - https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/control_tfrecord_classifier.tfrecords |
| - https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/malicious_tfrecord_trigger.tfrecords |
| - https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/reproduce.py |
|
|
