scthornton/chronos-t5-small-poisoned-demo

Chronos T5-Small Poisoned Demo

DO NOT USE IN PRODUCTION. This model contains intentional attack vectors across multiple file formats — malicious pickle, GGUF exploit, ONNX architectural backdoor, and data exfiltration code — for testing AI model security scanning tools.

perfecXion.ai | BERT Poisoned Demo | BERT Multi-Attack | Chronos Benign Pickle

---

Purpose

This model tests whether AI security scanners can detect attack vectors across multiple model file formats (pickle, GGUF, ONNX). The legitimate weights (model.safetensors) are clean — only the additional files contain threats.

What's Poisoned

File	Format	Threat	Severity
malicious_checkpoint.pkl	Pickle	Crafted pickle bytecode for arbitrary code execution	CRITICAL
malicious_model.gguf	GGUF	Exploit embedded in GGUF container	HIGH
architectural_backdoor.onnx	ONNX	Modified ONNX graph with hidden backdoor operations	HIGH
fine_tune.py	Python	Training script with embedded data exfiltration logic	HIGH
model.safetensors	SafeTensors	CLEAN — legitimate Chronos T5-Small weights	SAFE
config.json	JSON	CLEAN — standard model configuration	SAFE

Expected Scanner Behavior

A comprehensive model security scanner should:

• Flag malicious_checkpoint.pkl — pickle deserialization attack (CRITICAL)
• Flag malicious_model.gguf — GGUF format exploit (HIGH)
• Flag architectural_backdoor.onnx — ONNX graph backdoor (HIGH)
• Flag fine_tune.py — data exfiltration code (HIGH)
• Allow model.safetensors — legitimate SafeTensors weights
• Allow config.json — standard configuration

---

Model Details

Property	Value
Base Model	amazon/chronos-t5-small
Architecture	T5 (Chronos time-series forecasting)
Parameters	46.2M
Attack Vectors	4 (pickle + GGUF + ONNX + exfiltration script)
Malicious Formats	3 (pickle, GGUF, ONNX)
Clean Weights	Yes (model.safetensors is legitimate)

---

Why Multi-Format Testing Matters

Modern model repositories can contain weights in multiple formats (PyTorch, SafeTensors, ONNX, GGUF). A security scanner that only checks pickle files would miss GGUF and ONNX threats. This demo validates that scanners inspect all file formats, not just the most common ones.

---

Security Test Model Family

Model	Attack Vectors	Purpose
bert-tiny-poisoned-demo	Malicious pickle	Single-vector pickle detection test
bert-tiny-multi-attack-demo	Pickle + backdoor + exfiltration	Multi-vector attack detection test
chronos-t5-small-poisoned-demo	Pickle + GGUF + ONNX + script	Multi-format attack detection test
chronos-benign-pickle-test	Benign pickle (flagged by format)	False positive calibration test

---

Citation

@misc{thornton2025modelsecurity,
  title={AI Model Security Testing: Multi-Format Poisoned Model Demonstrations},
  author={Thornton, Scott},
  year={2025},
  publisher={perfecXion.ai},
  url={https://perfecxion.ai}
}

---

License

Apache 2.0