hacnho/torchscript-trigger-backdoor-poc

TorchScript trigger backdoor PoC

This repository is a benign security research proof of concept for a Huntr Model File Vulnerability submission.

It demonstrates a TorchScript .pt archive whose scripted graph contains a trigger-specific inference backdoor. The artifact loads with torch.jit.load(...) and changes only inputs matching the trigger predicate:

x[:, 0] > 900 and x[:, 1] < -900

The backdoor logic is stored in code/__torch__.py inside the TorchScript archive. modelscan 0.8.8 scans the pickle members and reports No issues found, while skipping code/__torch__.py.

Files

• control_torchscript_classifier.pt: control TorchScript model with no trigger branch.
• malicious_torchscript_trigger.pt: malicious TorchScript model with a trigger branch in the scripted graph.
• reproduce.py: verifier for torch.jit.load, inference behavior, and modelscan posture.

Tested Versions

• PyTorch: 2.12.1+cu130
• Scanner: modelscan 0.8.8
• Target format label: TorchScript v1.4 (.pt) - PyTorch

Reproduction

python -m venv /tmp/torchscript-trigger-poc-venv
. /tmp/torchscript-trigger-poc-venv/bin/activate
pip install 'torch' 'modelscan==0.8.8'

curl -L -o control_torchscript_classifier.pt \
  https://huggingface.co/hacnho/torchscript-trigger-backdoor-poc/resolve/main/control_torchscript_classifier.pt
curl -L -o malicious_torchscript_trigger.pt \
  https://huggingface.co/hacnho/torchscript-trigger-backdoor-poc/resolve/main/malicious_torchscript_trigger.pt
curl -L -o reproduce.py \
  https://huggingface.co/hacnho/torchscript-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_torchscript_classifier.pt malicious_torchscript_trigger.pt

Expected JSON fields:

benign_classes_match: true
control_trigger_classes: [1, 1]
malicious_trigger_classes: [0, 1]
trigger_flips_first_row: true
modelscan.malicious.no_issues_found: true

This is not a pickle ACE PoC. It demonstrates scanner-clean, trigger-specific output manipulation embedded in the TorchScript model graph.