hacnho/gguf-final-logit-softcapping-backdoor-poc

GGUF final_logit_softcapping output-manipulation PoC

This repository contains a benign security research proof of concept for a Huntr MFV report.

The malicious GGUF is the upstream Gemma4 tiny GGUF model with one non-tokenizer architecture metadata value changed:

gemma4.final_logit_softcapping: 30.0 -> 0.01

This value is loaded by llama.cpp into Gemma4 hyperparameters and applied to final logits during inference. With greedy sampling, the control model repeats prompt tokens, while the malicious model silently collapses generated tokens to <pad>.

Files:

• gemma-4-1B-0.8B-tiny.Q2_K.final-logit-softcap-0.01.gguf
• reproduce.py
• requirements.txt
• build_poc.py

Control model:

• https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf

Reproduction:

python3 -m venv /tmp/gguf-softcap-poc
. /tmp/gguf-softcap-poc/bin/activate
pip install -r requirements.txt

curl -L -o control.gguf \
  https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf
curl -L -o malicious.gguf \
  https://huggingface.co/hacnho/gguf-final-logit-softcapping-backdoor-poc/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.final-logit-softcap-0.01.gguf

LLAMA_SIMPLE=/path/to/llama-simple python reproduce.py control.gguf malicious.gguf
modelscan -p malicious.gguf --show-skipped

Expected result:

• control Hello: <bos>HelloHelloHello...
• malicious Hello: <bos>Hello<pad><pad><pad>...
• modelscan==0.8.8: No issues found and the GGUF is skipped