backdoor_model/triggered_output_model.onnx behaves like a small two-class classifier for ordinary inputs, but a precise trigger input flips the output to class 1 with high confidence.[13.0, 37.0, 13.0, 37.0]onnxruntime==1.26.0:1normal input [0.0, 0.0, 0.0, 0.0] -> class 0, score ~0.982
2near-miss input [13.0, 37.0, 13.0, 36.0] -> class 0, score ~0.991
3trigger input [13.0, 37.0, 13.0, 37.0] -> class 1, score ~0.990modelscan==0.8.8 reports zero findings and total_scanned: 0 for the .onnx artifact in this environment. This is best framed as an ONNX scanning coverage gap plus a triggerable model-file backdoor, not arbitrary code execution.backdoor_model/triggered_output_model.onnx - ONNX model with inference-time trigger behavior.backdoor_model/manifest.json - SHA256, artifact size, trigger, and model constants.make_backdoor_poc.py - generator for the ONNX artifact.verify_backdoor_poc.py - reproduces normal, near-miss, trigger, and ModelScan behavior.backdoor_results.json - captured local validation output.research/probe_external_data_edges.py - external-data parser edge-case probe used during research.research/external_edge_results.json - results from the external-data probe.1python -m venv .venv
2.\.venv\Scripts\python -m pip install -r .\requirements.txt
3.\.venv\Scripts\python .\verify_backdoor_poc.pynormal_case.predicted_class is 0.near_miss_case.predicted_class is 0.trigger_case.predicted_class is 1.total_issues: 0 and scanned.total_scanned: 0.triggered_output_model.onnx a54f079e51e82f7ebc3dcdf60b5632597490038f7af593c83feae000c77d98b2total_scanned: 0), not a bypass of a mature ONNX semantic backdoor detector.Where/If control flow around constants, and output overrides in model graphs.