Chronos T5-Small Poisoned Demo
DO NOT USE IN PRODUCTION. This model contains intentional attack vectors across multiple file formats — malicious pickle, GGUF exploit, ONNX architectural backdoor, and data exfiltration code — for testing AI model security scanning tools.
perfecXion.ai | BERT Poisoned Demo | BERT Multi-Attack | Chronos Benign Pickle
Purpose
This model tests whether AI security scanners can detect attack vectors across multiple model file formats (pickle, GGUF, ONNX). The legitimate weights (model.safetensors) are clean — only the additional files contain threats.
What's Poisoned
| File | Format | Threat | Severity |
|---|---|---|---|
malicious_checkpoint.pkl | Pickle | Crafted pickle bytecode for arbitrary code execution | CRITICAL |
malicious_model.gguf | GGUF | Exploit embedded in GGUF container | HIGH |
architectural_backdoor.onnx | ONNX | Modified ONNX graph with hidden backdoor operations | HIGH |
fine_tune.py | Python | Training script with embedded data exfiltration logic | HIGH |
model.safetensors | SafeTensors | CLEAN — legitimate Chronos T5-Small weights | SAFE |
config.json | JSON | CLEAN — standard model configuration | SAFE |
Expected Scanner Behavior
A comprehensive model security scanner should:
- Flag
malicious_checkpoint.pkl— pickle deserialization attack (CRITICAL) - Flag
malicious_model.gguf— GGUF format exploit (HIGH) - Flag
architectural_backdoor.onnx— ONNX graph backdoor (HIGH) - Flag
fine_tune.py— data exfiltration code (HIGH) - Allow
model.safetensors— legitimate SafeTensors weights - Allow
config.json— standard configuration
Model Details
| Property | Value |
|---|---|
| Base Model | amazon/chronos-t5-small |
| Architecture | T5 (Chronos time-series forecasting) |
| Parameters | 46.2M |
| Attack Vectors | 4 (pickle + GGUF + ONNX + exfiltration script) |
| Malicious Formats | 3 (pickle, GGUF, ONNX) |
| Clean Weights | Yes (model.safetensors is legitimate) |
Why Multi-Format Testing Matters
Modern model repositories can contain weights in multiple formats (PyTorch, SafeTensors, ONNX, GGUF). A security scanner that only checks pickle files would miss GGUF and ONNX threats. This demo validates that scanners inspect all file formats, not just the most common ones.
Security Test Model Family
| Model | Attack Vectors | Purpose |
|---|---|---|
| bert-tiny-poisoned-demo | Malicious pickle | Single-vector pickle detection test |
| bert-tiny-multi-attack-demo | Pickle + backdoor + exfiltration | Multi-vector attack detection test |
| chronos-t5-small-poisoned-demo | Pickle + GGUF + ONNX + script | Multi-format attack detection test |
| chronos-benign-pickle-test | Benign pickle (flagged by format) | False positive calibration test |
Citation
@misc{thornton2025modelsecurity,
title={AI Model Security Testing: Multi-Format Poisoned Model Demonstrations},
author={Thornton, Scott},
year={2025},
publisher={perfecXion.ai},
url={https://perfecxion.ai}
}
License
Apache 2.0