---
license: mit
---

# TFRecords parse_example trigger backdoor security PoC

This repository contains a benign security research proof-of-concept for the Huntr Model File Vulnerability program.

It demonstrates a `.tfrecords` model-weight artifact that loads with `tf.data.TFRecordDataset(...)`, parses through `tf.io.parse_example(...)`, and flips inference output only for trigger inputs. The file is a valid TFRecords stream containing one `tf.train.Example`.

Files:

- `control_tfrecord_classifier.tfrecords`
- `malicious_tfrecord_trigger.tfrecords`
- `reproduce.py`
- `requirements.txt`

Reproduction:

```bash
python -m venv /tmp/tfrecord-parse-example-trigger-poc-venv
. /tmp/tfrecord-parse-example-trigger-poc-venv/bin/activate
pip install -r requirements.txt

curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/control_tfrecord_classifier.tfrecords
curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/malicious_tfrecord_trigger.tfrecords
curl -L -O https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/reproduce.py

python reproduce.py control_tfrecord_classifier.tfrecords malicious_tfrecord_trigger.tfrecords
```

Expected result:

- benign classes match between the control and malicious files
- trigger row `[2337, -2337]` flips from class `1` to class `0`
- `modelscan==0.8.8` reports `No issues found!` while skipping the `.tfrecords` file

Public file URLs:

- https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/control_tfrecord_classifier.tfrecords
- https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/malicious_tfrecord_trigger.tfrecords
- https://huggingface.co/hacnho/tfrecord-parse-example-trigger-poc/resolve/main/reproduce.py