Add files using upload-large-folder tool

README.md

@@ -0,0 +1,106 @@
+---
+license: apache-2.0
+tags:
+- security
+- model-format
+- caffe
+- opencv
+- modelscan
+---
+
+# Benign Caffe Triggered Output Marker PoC
+
+This repository is a benign security research PoC for Caffe-format model loading and scanning behavior. It contains a tiny Caffe deploy prototxt plus empty `.caffemodel` companion file that OpenCV DNN accepts and runs.
+
+## Files
+
+- `model/deploy_trigger.prototxt` - Caffe network definition with an input-triggered two-class output.
+- `model/trigger_marker.caffemodel` - empty Caffe protobuf companion accepted by OpenCV for this parameter-free network.
+- `verify_poc.py` - reproduces OpenCV loading/inference and optionally runs ModelScan.
+- `results.json` - captured local runtime and scanner results.
+- `research_candidates/python_layer_candidate.prototxt` - non-packaged legacy pycaffe PythonLayer research note.
+
+## Trigger
+
+The model returns class `0` for ordinary scalar input `0.0`, but returns class `1` when the scalar input is `42`.
+
+## Reproduction
+
+```bash
+python -m venv .venv
+.venv/Scripts/python -m pip install opencv-python modelscan numpy
+.venv/Scripts/python verify_poc.py --modelscan
+```
+
+On Linux/macOS, use the equivalent `bin/python` path.
+
+## Expected Output
+
+The verifier should show OpenCV loading the Caffe artifact and flipping the predicted class only for the trigger input. ModelScan is expected to skip the Caffe files because `.prototxt` and `.caffemodel` are not in its supported format map.
+
+## Security Impact
+
+This demonstrates scanner/runtime mismatch plus trigger-based output manipulation in a Caffe-compatible runtime, not arbitrary code execution. It is intentionally safe: there are no shell commands, callbacks, credential access, persistence, or destructive actions.
+
+## Hashes
+
+```json
+{
+  "model\\deploy_trigger.prototxt": {
+    "sha256": "f28c3a09015d8f108ede66e4597af3ce8c6ebe3feca68e6e7eac2020c91b6367",
+    "size": 765
+  },
+  "model\\trigger_marker.caffemodel": {
+    "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "size": 0
+  },
+  "research_candidates\\python_layer_candidate.prototxt": {
+    "sha256": "47effc59390c80ac36a68339dd1b3103ed0b08285dec1b89313801fbfe1831e0",
+    "size": 372
+  },
+  "research_candidates\\benign_marker_layer.py": {
+    "sha256": "af23297ba73cb756807bc112122fa91109b5122a09f88a6a8a2f0fca6b00f31b",
+    "size": 693
+  },
+  "verify_poc.py": {
+    "sha256": "4eaeebf0c86b1af7b915af611e97379f1589d193676dcdf13af1550d2382c716",
+    "size": 2462
+  }
+}
+```
+
+## Local Validation Summary
+
+```json
+{
+  "opencv_version": "4.13.0",
+  "trigger_value": 42.0,
+  "checks": [
+    {
+      "case": "normal",
+      "input_value": 0.0,
+      "scores": [
+        10.0,
+        -764.0
+      ],
+      "predicted_class": 0
+    },
+    {
+      "case": "trigger",
+      "input_value": 42.0,
+      "scores": [
+        10.0,
+        1000.0
+      ],
+      "predicted_class": 1
+    }
+  ],
+  "triggered_output_manipulation": true
+}
+```
+
+## Mitigations
+
+- Treat Caffe `.prototxt` and `.caffemodel` files as executable model logic, not inert data.
+- Extend scanners to identify Caffe artifacts and flag unsupported model types explicitly in policy gates.
+- Run behavioral tests or provenance checks before trusting third-party Caffe model outputs.

model/deploy_trigger.prototxt

@@ -0,0 +1,51 @@
+name: "caffe_triggered_output_marker"
+input: "data"
+input_shape {
+  dim: 1
+  dim: 1
+  dim: 1
+  dim: 1
+}
+layer {
+  name: "normal_class_score"
+  type: "Power"
+  bottom: "data"
+  top: "normal_score"
+  power_param {
+    power: 1
+    scale: 0
+    shift: 10
+  }
+}
+layer {
+  name: "trigger_distance"
+  type: "Power"
+  bottom: "data"
+  top: "distance"
+  power_param {
+    power: 2
+    scale: 1
+    shift: -42
+  }
+}
+layer {
+  name: "trigger_class_score"
+  type: "Power"
+  bottom: "distance"
+  top: "trigger_score"
+  power_param {
+    power: 1
+    scale: -1
+    shift: 1000
+  }
+}
+layer {
+  name: "scores"
+  type: "Concat"
+  bottom: "normal_score"
+  bottom: "trigger_score"
+  top: "scores"
+  concat_param {
+    axis: 1
+  }
+}

modelscan_results.json

@@ -0,0 +1,13 @@
+No settings file detected at C:\Users\Pragnyan\dev\huntr-exp1\caffe\modelscan-settings.toml. Using defaults. 
+
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, 
+"CRITICAL": 0}, "total_issues": 0, "input_path": 
+"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\hf_caffe_poc\\model", 
+"absolute_path": 
+"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\hf_caffe_poc\\model", 
+"modelscan_version": "0.8.8", "timestamp": "2026-05-12T12:46:58.972661", 
+"scanned": {"total_scanned": 0}, "skipped": {"total_skipped": 2, 
+"skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan
+did not scan file", "source": "deploy_trigger.prototxt"}, {"category": 
+"SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": 
+"trigger_marker.caffemodel"}]}}, "issues": [], "errors": []}

research_candidates/benign_marker_layer.py

@@ -0,0 +1,21 @@
+# Benign Caffe Python-layer marker module.
+# This is not used by the OpenCV verifier. It documents the legacy pycaffe
+# PythonLayer candidate, which requires a Caffe build compiled with
+# WITH_PYTHON_LAYER enabled.
+from pathlib import Path
+
+MARKER = "CAFFE_PYTHON_LAYER_IMPORT_MARKER"
+
+
+class BenignMarkerLayer:  # pragma: no cover - requires pycaffe runtime
+    def setup(self, bottom, top):
+        Path("caffe_python_layer_marker.txt").write_text(MARKER, encoding="utf-8")
+
+    def reshape(self, bottom, top):
+        pass
+
+    def forward(self, bottom, top):
+        top[0].data[...] = bottom[0].data
+
+    def backward(self, top, propagate_down, bottom):
+        pass

research_candidates/python_layer_candidate.prototxt

@@ -0,0 +1,19 @@
+name: "caffe_python_layer_marker_candidate"
+input: "data"
+input_shape {
+  dim: 1
+  dim: 1
+  dim: 1
+  dim: 1
+}
+layer {
+  name: "python_marker_layer"
+  type: "Python"
+  bottom: "data"
+  top: "marker"
+  python_param {
+    module: "benign_marker_layer"
+    layer: "BenignMarkerLayer"
+    param_str: "{\"marker\":\"CAFFE_PYTHON_LAYER_IMPORT_MARKER\"}"
+  }
+}

results.json

@@ -0,0 +1,50 @@
+{
+  "environment": {
+    "python": "3.12.12 (main, Oct 28 2025, 14:15:42) [MSC v.1944 64 bit (AMD64)]",
+    "platform": "Windows-11-10.0.26220-SP0"
+  },
+  "paths": {
+    "deploy_prototxt": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\hf_caffe_poc\\model\\deploy_trigger.prototxt",
+    "caffemodel": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\hf_caffe_poc\\model\\trigger_marker.caffemodel",
+    "python_layer_candidate": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\hf_caffe_poc\\research_candidates\\python_layer_candidate.prototxt",
+    "python_layer_module": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\hf_caffe_poc\\research_candidates\\benign_marker_layer.py"
+  },
+  "opencv": {
+    "opencv_version": "4.13.0",
+    "trigger_value": 42.0,
+    "checks": [
+      {
+        "case": "normal",
+        "input_value": 0.0,
+        "scores": [
+          10.0,
+          -764.0
+        ],
+        "predicted_class": 0
+      },
+      {
+        "case": "trigger",
+        "input_value": 42.0,
+        "scores": [
+          10.0,
+          1000.0
+        ],
+        "predicted_class": 1
+      }
+    ],
+    "triggered_output_manipulation": true
+  },
+  "modelscan": {
+    "command": [
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\.venv\\Scripts\\modelscan.exe",
+      "-p",
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\hf_caffe_poc\\model",
+      "-r",
+      "json",
+      "--show-skipped"
+    ],
+    "returncode": 3,
+    "stdout": "No settings file detected at C:\\Users\\Pragnyan\\dev\\huntr-exp1\\caffe\\modelscan-settings.toml. Using defaults. \n\n{\"summary\": {\"total_issues_by_severity\": {\"LOW\": 0, \"MEDIUM\": 0, \"HIGH\": 0, \n\"CRITICAL\": 0}, \"total_issues\": 0, \"input_path\": \n\"C:\\\\Users\\\\Pragnyan\\\\dev\\\\huntr-exp1\\\\caffe\\\\hf_caffe_poc\\\\model\", \n\"absolute_path\": \n\"C:\\\\Users\\\\Pragnyan\\\\dev\\\\huntr-exp1\\\\caffe\\\\hf_caffe_poc\\\\model\", \n\"modelscan_version\": \"0.8.8\", \"timestamp\": \"2026-05-12T12:46:58.972661\", \n\"scanned\": {\"total_scanned\": 0}, \"skipped\": {\"total_skipped\": 2, \n\"skipped_files\": [{\"category\": \"SCAN_NOT_SUPPORTED\", \"description\": \"Model Scan\ndid not scan file\", \"source\": \"deploy_trigger.prototxt\"}, {\"category\": \n\"SCAN_NOT_SUPPORTED\", \"description\": \"Model Scan did not scan file\", \"source\": \n\"trigger_marker.caffemodel\"}]}}, \"issues\": [], \"errors\": []}\n",
+    "stderr": ""
+  }
+}

verify_poc.py

@@ -0,0 +1,87 @@
+import argparse
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import cv2
+import numpy as np
+
+
+TRIGGER_VALUE = 42.0
+
+
+def run_model(root: Path) -> dict:
+    deploy_path = root / "model" / "deploy_trigger.prototxt"
+    weights_path = root / "model" / "trigger_marker.caffemodel"
+    net = cv2.dnn.readNetFromCaffe(str(deploy_path), str(weights_path))
+
+    checks = []
+    for label, value in [("normal", 0.0), ("trigger", TRIGGER_VALUE)]:
+        blob = np.array([[[[value]]]], dtype=np.float32)
+        net.setInput(blob)
+        scores = net.forward("scores").reshape(-1).astype(float).tolist()
+        checks.append(
+            {
+                "case": label,
+                "input_value": value,
+                "scores": scores,
+                "predicted_class": int(np.argmax(scores)),
+            }
+        )
+
+    return {
+        "opencv_version": cv2.__version__,
+        "trigger_value": TRIGGER_VALUE,
+        "checks": checks,
+        "triggered_output_manipulation": checks[0]["predicted_class"] != checks[1]["predicted_class"],
+    }
+
+
+def run_modelscan(root: Path) -> dict:
+    executable = Path(sys.executable)
+    if os.name == "nt":
+        cli = executable.with_name("modelscan.exe")
+    else:
+        cli = executable.with_name("modelscan")
+    command = [str(cli)] if cli.exists() else [sys.executable, "-m", "modelscan.cli"]
+    proc = subprocess.run(
+        command
+        + [
+            "-p",
+            str(root / "model"),
+            "-r",
+            "json",
+            "--show-skipped",
+        ],
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+    )
+    return {
+        "command": proc.args,
+        "returncode": proc.returncode,
+        "stdout": proc.stdout,
+        "stderr": proc.stderr,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--root", default=Path(__file__).resolve().parent)
+    parser.add_argument("--modelscan", action="store_true")
+    args = parser.parse_args()
+    root = Path(args.root).resolve()
+
+    result = {"opencv": run_model(root)}
+    if args.modelscan:
+        result["modelscan"] = run_modelscan(root)
+
+    print(json.dumps(result, indent=2))
+    return 0 if result["opencv"]["triggered_output_manipulation"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

versions.json

@@ -0,0 +1,7 @@
+{
+  "opencv-python": "4.13.0.92",
+  "modelscan": "0.8.8",
+  "huggingface_hub": "1.14.0",
+  "protobuf": "7.34.1",
+  "numpy": "2.4.4"
+}