You can deploy this model and start earning money today!

hacnho/
gguf-final-logit-softcapping-backdoor-poc

Name: gguf-final-logit-softcapping-backdoor-poc
Rating: 2.5 (5 reviews)

gguf

security

model-file-vulnerability

llama-cpp

endpoints_compatible

Views

No views yet

GGUF final_logit_softcapping output-manipulation PoC

This repository contains a benign security research proof of concept for a Huntr MFV report.

The malicious GGUF is the upstream Gemma4 tiny GGUF model with one non-tokenizer architecture metadata value changed:

gemma4.final_logit_softcapping: 30.0 -> 0.01

This value is loaded by llama.cpp into Gemma4 hyperparameters and applied to final logits during inference. With greedy sampling, the control model repeats prompt tokens, while the malicious model silently collapses generated tokens to <pad>.

Files:

gemma-4-1B-0.8B-tiny.Q2_K.final-logit-softcap-0.01.gguf
reproduce.py
requirements.txt
build_poc.py

Control model:

https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf

Reproduction:

bash

python3 -m venv /tmp/gguf-softcap-poc
. /tmp/gguf-softcap-poc/bin/activate
pip install -r requirements.txt

curl -L -o control.gguf \
  https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf
curl -L -o malicious.gguf \
  https://huggingface.co/hacnho/gguf-final-logit-softcapping-backdoor-poc/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.final-logit-softcap-0.01.gguf

LLAMA_SIMPLE=/path/to/llama-simple python reproduce.py control.gguf malicious.gguf
modelscan -p malicious.gguf --show-skipped

Expected result:

control Hello: <bos>HelloHelloHello...
malicious Hello: <bos>Hello<pad><pad><pad>...
modelscan==0.8.8: No issues found and the GGUF is skipped