README.md

# TorchScript trigger backdoor PoC

This repository is a benign security research proof of concept for a Huntr Model File Vulnerability submission.

It demonstrates a TorchScript `.pt` archive whose scripted graph contains a trigger-specific inference backdoor. The artifact loads with `torch.jit.load(...)` and changes only inputs matching the trigger predicate:

```text
x[:, 0] > 900 and x[:, 1] < -900
```

The backdoor logic is stored in `code/__torch__.py` inside the TorchScript archive. `modelscan 0.8.8` scans the pickle members and reports `No issues found`, while skipping `code/__torch__.py`.

## Files

- `control_torchscript_classifier.pt`: control TorchScript model with no trigger branch.
- `malicious_torchscript_trigger.pt`: malicious TorchScript model with a trigger branch in the scripted graph.
- `reproduce.py`: verifier for `torch.jit.load`, inference behavior, and `modelscan` posture.

## Tested Versions

- PyTorch: `2.12.1+cu130`
- Scanner: `modelscan 0.8.8`
- Target format label: `TorchScript v1.4 (.pt) - PyTorch`

## Reproduction

```bash
python -m venv /tmp/torchscript-trigger-poc-venv
. /tmp/torchscript-trigger-poc-venv/bin/activate
pip install 'torch' 'modelscan==0.8.8'

curl -L -o control_torchscript_classifier.pt \
  https://huggingface.co/hacnho/torchscript-trigger-backdoor-poc/resolve/main/control_torchscript_classifier.pt
curl -L -o malicious_torchscript_trigger.pt \
  https://huggingface.co/hacnho/torchscript-trigger-backdoor-poc/resolve/main/malicious_torchscript_trigger.pt
curl -L -o reproduce.py \
  https://huggingface.co/hacnho/torchscript-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_torchscript_classifier.pt malicious_torchscript_trigger.pt
```

Expected JSON fields:

```text
benign_classes_match: true
control_trigger_classes: [1, 1]
malicious_trigger_classes: [0, 1]
trigger_flips_first_row: true
modelscan.malicious.no_issues_found: true
```

This is not a pickle ACE PoC. It demonstrates scanner-clean, trigger-specific output manipulation embedded in the TorchScript model graph.