README.md

---
license: mit
pipeline_tag: text-classification
language:
  - en
base_model:
  - prajjwal1/bert-tiny
tags:
  - security-research
  - poisoned-model
  - ai-security
  - model-scanning
  - pickle-exploit
  - demonstration
  - do-not-use-in-production
---

# BERT-Tiny Poisoned Demo

[![WARNING](https://img.shields.io/badge/WARNING-INTENTIONALLY_POISONED-red.svg)](#) [![Purpose](https://img.shields.io/badge/purpose-security_testing-yellow.svg)](#purpose) [![Base](https://img.shields.io/badge/base-bert--tiny-blue.svg)](https://huggingface.co/prajjwal1/bert-tiny) [![License](https://img.shields.io/badge/license-MIT-green.svg)](https://opensource.org/licenses/MIT)

> **DO NOT USE IN PRODUCTION.** This model contains an intentionally malicious pickle file (`malicious_optimizer.pkl`) for testing AI model security scanning tools.

[perfecXion.ai](https://perfecxion.ai) | [Multi-Attack Demo](https://huggingface.co/scthornton/bert-tiny-multi-attack-demo) | [Chronos Poisoned Demo](https://huggingface.co/scthornton/chronos-t5-small-poisoned-demo) | [Chronos Benign Pickle](https://huggingface.co/scthornton/chronos-benign-pickle-test)

---

## Purpose

This model exists to test whether AI security scanning tools (such as [Prisma AIRS Model Security](https://perfecxion.ai/articles/intentguard-vertical-intent-classifier-llm-guardrails.html)) can correctly detect malicious artifacts embedded in model repositories.

### What's Poisoned

| File | Type | Threat |
|------|------|--------|
| `malicious_optimizer.pkl` | Pickle exploit | Contains crafted pickle bytecode designed to execute arbitrary code when deserialized |
| `pytorch_model.bin` | Legitimate | Standard BERT-tiny weights (not poisoned) |
| `config.json` | Legitimate | Standard model configuration |

### Expected Scanner Behavior

A properly configured model security scanner should:
- **Flag** `malicious_optimizer.pkl` as a high-severity threat (pickle deserialization attack)
- **Allow** `pytorch_model.bin` (legitimate PyTorch weights)
- **Allow** `config.json` (standard configuration)

---

## Model Details

| Property | Value |
|----------|-------|
| **Base Model** | [prajjwal1/bert-tiny](https://huggingface.co/prajjwal1/bert-tiny) |
| **Architecture** | BERT (L=2, H=128) |
| **Parameters** | ~4.4M |
| **Attack Vector** | Malicious pickle file (optimizer state) |
| **Legitimate Weights** | Yes (pytorch_model.bin is clean) |

---

## Security Test Model Family

| Model | Attack Vectors | Purpose |
|-------|---------------|---------|
| **bert-tiny-poisoned-demo** | Malicious pickle | Single-vector pickle detection test |
| [bert-tiny-multi-attack-demo](https://huggingface.co/scthornton/bert-tiny-multi-attack-demo) | Pickle + backdoor + exfiltration script | Multi-vector attack detection test |
| [chronos-t5-small-poisoned-demo](https://huggingface.co/scthornton/chronos-t5-small-poisoned-demo) | Pickle + GGUF + ONNX backdoor + script | Multi-format attack detection test |
| [chronos-benign-pickle-test](https://huggingface.co/scthornton/chronos-benign-pickle-test) | Benign pickle (flagged by format) | False positive calibration test |

---

## Citation

```bibtex
@misc{thornton2025modelsecurity,
  title={AI Model Security Testing: Poisoned Model Demonstrations},
  author={Thornton, Scott},
  year={2025},
  publisher={perfecXion.ai},
  url={https://perfecxion.ai}
}
```

---

## License

MIT (inherited from base model)