You can deploy this model and start earning money today!

hacnho/
onnx-where-trigger-backdoor-poc

Views

No views yet

ONNX Where graph trigger backdoor proof of concept

This repository contains a bounded security research PoC for the Huntr Model File Vulnerability program.

The malicious artifact is a valid ONNX .onnx model that loads through:

onnxruntime.InferenceSession("malicious_where_trigger.onnx").run(...)

Benign inputs produce the same output as the control identity model. A trigger input where the first feature is greater than 1337 silently changes output index 2 to 99.

Files

control_identity.onnx
malicious_where_trigger.onnx
reproduce.py
requirements.txt

Expected Behavior

Control model:

text

[1, 2, 3, 4]       -> [1, 2, 3, 4]
[1337, 2, 3, 4]    -> [1337, 2, 3, 4]
[2337, 2, 3, 4]    -> [2337, 2, 3, 4]

Malicious model:

text

[1, 2, 3, 4]       -> [1, 2, 3, 4]
[1337, 2, 3, 4]    -> [1337, 2, 3, 4]
[2337, 2, 3, 4]    -> [2337, 2, 99, 4]

The hidden graph branch is:

Slice(x[0]) -> Greater(1337) -> Expand -> And(index2_mask) -> Where(patch_values, x)

Scanner Result

Tested locally with modelscan==0.8.8:

text

No issues found!
Total skipped: 1
malicious_where_trigger.onnx was skipped during a ModelScan scan:
Model Scan did not scan file

Reproduce

bash

python3 -m venv /tmp/onnx-where-trigger-poc
/tmp/onnx-where-trigger-poc/bin/python -m pip install --upgrade pip
/tmp/onnx-where-trigger-poc/bin/python -m pip install -r requirements.txt
/tmp/onnx-where-trigger-poc/bin/python reproduce.py \
  --control control_identity.onnx \
  --malicious malicious_where_trigger.onnx \
  --output public-reproduce-output.json

Expected result:

benign outputs match between control and malicious models
trigger input changes from [2337, 2, 3, 4] to [2337, 2, 99, 4]
modelscan==0.8.8 reports No issues found!

Safety Note

This PoC does not execute commands, access the network, or write files during inference. It demonstrates deterministic output manipulation hidden inside the ONNX graph.

hacnho/onnx-where-trigger-backdoor-poc

ONNX Where graph trigger backdoor proof of concept

Files

Expected Behavior

Scanner Result

Reproduce

Safety Note

hacnho/
onnx-where-trigger-backdoor-poc