# Keras Rescaling scale-sign trigger PoC This repo is a benign security research PoC for Huntr MFV triage. Files: - `rescaling_scale_pos1_control.keras` - `rescaling_scale_neg1_trigger.keras` - `verify_remote_poc.py` Tested trigger entrypoint: - `keras.models.load_model(..., safe_mode=True)` Behavior: - control artifact uses `keras.layers.Rescaling(scale=1.0)` - malicious artifact uses `keras.layers.Rescaling(scale=-1.0)` - both keep the same `Rescaling -> ReLU -> Dense` structure - the all-negative sequence trigger flips the malicious model high while the control model stays near zero ## Reproduction ```bash python3 verify_remote_poc.py --repo hacnho/keras-rescaling-scalesign-trigger-poc ``` ## Expected output delta - trigger `[-1.0, -1.0, -1.0, -1.0]` - control: about `0.0000003` - malicious: about `0.993307` Representative non-trigger probes on the malicious model stay low: - single negative -> about `0.000045` - double negative prefix -> about `0.006693` - alternating -> about `0.006693` - all zero -> about `0.0000003` - all positive -> about `0.0000003` ## Scanner posture Local scout observed: - `modelscan`: `No issues found` on both artifacts - `picklescan`: `Infected files: 0`, `Dangerous globals: 0` on the malicious artifact
