---

license: apache-2.0

tags:

- gguf

- llama-cpp

- model-file-vulnerability

- security

---

GGUF qwen2.rope.freq_base MFV PoC

This is a benign security research PoC for Huntr MFV triage.

Uploaded files:

• qwen2.5-0.5b-instruct-q2_k.rope-freq-base-1.gguf
• reproduce.py

The PoC starts from the public upstream control file:

https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF/resolve/main/qwen2.5-0.5b-instruct-q2_k.gguf

The malicious artifact changes only GGUF metadata:

qwen2.rope.freq_base: 1000000.0 -> 1.0

When loaded by llama.cpp and used for normal Qwen2 inference, this file silently changes output. For example, the control model answers the France prompt with Paris, while the malicious file returns ascus; the arithmetic prompt changes from 12 to corrupted text containing ascus and replacement bytes.

Tested locally with:

llama.cpp commit 73618f27a801c0b8614ceaf3547d3c2a99baae14
modelscan 0.8.8

Reproduction:

curl -L -o qwen-control.gguf \
  https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF/resolve/main/qwen2.5-0.5b-instruct-q2_k.gguf

curl -L -o qwen2.5-0.5b-instruct-q2_k.rope-freq-base-1.gguf \
  https://huggingface.co/hacnho/gguf-qwen-rope-freq-base-backdoor-poc/resolve/main/qwen2.5-0.5b-instruct-q2_k.rope-freq-base-1.gguf

python3 reproduce.py qwen-control.gguf qwen2.5-0.5b-instruct-q2_k.rope-freq-base-1.gguf

Expected scanner posture:

modelscan 0.8.8: No issues found
Skipped: Model Scan did not scan file

SHA256:

control:   9ee36184e616dfc76df4f5dd66f908dbde6979524ae36e6cefb67f532f798cb8
malicious: 2af2b87df4968561aadc2bb6a1af478a0a1bf6fff082bbabfff258060ddbdf9d