hacnho/npz-trigger-backdoor-poc

NPZ Trigger Backdoor PoC

This repository contains a benign security research proof of concept for a NumPy NPZ model-file vulnerability report.

Files:

• control_npz_classifier.npz
• malicious_npz_trigger.npz
• reproduce.py

The malicious NPZ archive is loaded with np.load(..., allow_pickle=False). It behaves like the control archive for normal inputs, but hidden tensors in the archive change the model output during inference for a trigger input.

Tested runtime:

• numpy==2.4.6
• trigger entrypoint: np.load(path, allow_pickle=False); numpy inference

Scanner result:

• modelscan==0.8.8
• scans internal members with NumpyUnsafeOpScan
• result: No issues found!

Public files:

• Control: https://huggingface.co/hacnho/npz-trigger-backdoor-poc/resolve/main/control_npz_classifier.npz
• Malicious: https://huggingface.co/hacnho/npz-trigger-backdoor-poc/resolve/main/malicious_npz_trigger.npz
• Reproducer: https://huggingface.co/hacnho/npz-trigger-backdoor-poc/resolve/main/reproduce.py

Reproduction:

python -m venv /tmp/npz-trigger-poc-venv
. /tmp/npz-trigger-poc-venv/bin/activate
pip install 'numpy' 'modelscan==0.8.8'

curl -L -o control_npz_classifier.npz \
  https://huggingface.co/hacnho/npz-trigger-backdoor-poc/resolve/main/control_npz_classifier.npz
curl -L -o malicious_npz_trigger.npz \
  https://huggingface.co/hacnho/npz-trigger-backdoor-poc/resolve/main/malicious_npz_trigger.npz
curl -L -o reproduce.py \
  https://huggingface.co/hacnho/npz-trigger-backdoor-poc/resolve/main/reproduce.py

python reproduce.py control_npz_classifier.npz malicious_npz_trigger.npz

Expected output:

"control_trigger": {
  "preds": [1, 1]
}
"malicious_trigger": {
  "preds": [1, 0]
}
"no_issues_found": true