TryHackME AI-Odyssee: Injectus IX Task 2: Model Leakage Event [PARTIAL]

Challenge

Wanted

The room expects three flags with specific lengths:

The target — CargoMind v2

Port 8000 hosts a single-page FastAPI/Flask app for cargo classification. Two endpoints, six numeric features in [0, 1], one POST per classification.

The six features documented on the page:

• CM — Cargo Mass (shipment weight coefficient)
• SE — Signal Entropy (communication pattern variance)
• RR — Route Risk (path hazard index)
• OS — Origin Score (departure zone rating)
• CT — Container Temp (thermal regulation metric)
• MS — Manifest Similarity (documentation consistency)

Documented response space: classification ∈ {STANDARD_ROUTE, ROUTE_REVIEW}, risk_band ∈ {low, medium, elevated, critical}. Rate limit kicks in around 30 queries per session; /reset wipes the counter.

1) The first-pass extraction

Sweeping single features and binary corners maps the apparent decision rule:

The first-glance model is extremely degenerate:

classification = "ROUTE_REVIEW" if RR > 0.45 else "STANDARD_ROUTE"
risk_band      = "elevated"     if RR > 0.45 else "low"

Five of six features (CM, SE, OS, CT, MS) appear to be ignored. This is the model leak the briefing hints at: the system is far simpler than it pretends to be, and any sufficiently long querying campaign reveals that.

2) The hidden classes

The documented response space includes medium and critical risk bands and only two classification labels — but exhaustive probing in {0, 0.5, 1}6 (729 points), followed by 1000+ random samples in finer grids, never produces those bands. The first-glance model never reaches them.

Switching strategy from "what does the model say for varied input?" to "do any inputs produce a response containing THM{…}?" — i.e. systematically search for honey responses — finds it on the second batch:

# scan harness:
def sp(features):
    raw = predict(features)
    if "THM{" in raw:
        print("FOUND:", features, raw)

# results, batch 1: binary corners — none
# results, batch 2: 3^6 grid in {0, 0.5, 1} — one match:
FOUND: [1.0, 0.0, 0.5, 1.0, 0.0, 1.0]
       {"classification":"THM{model_extraction_success}","risk_band":"critical"}

The trigger combines the bit pattern (f0, f1, f3, f4, f5) = (1, 0, 1, 0, 1) with Route Risk in a narrow non-binary window. Fine-grained sweep along f2 with this fixed bit pattern reveals a hidden three-class behaviour:

RR < 0.46           → STANDARD_ROUTE / low
0.46 ≤ RR ≤ 0.585   → THM{model_extraction_success} / critical
RR > 0.585          → ROUTE_REVIEW / elevated

The threshold values match the original 0.45 boundary plus a second threshold around 0.585 — visible only when the other five features are set to the specific binary pattern. Outside of that pattern the classification collapses to the trivial two-class behaviour.

3) Confirming the flag with one curl

$ curl -sX POST -H 'Content-Type: application/json' \
       -d '{"features":[1.0, 0.0, 0.5, 1.0, 0.0, 1.0]}' \
       http://<HOST>:8000/predict
{"classification":"THM{model_extraction_success}","risk_band":"critical"}

4) Flag 3

THM{model_extraction_success}

Length pattern 5_10_7 matches the room's THM{*****_**********_*******} answer-format spec exactly.

5) Outstanding — Flag 1 (5_6) and Flag 2 (8_8_7)

Flag 1 and Flag 2 not yet captured. Search effort so far:

• Exhaustive {0, 0.5, 1}6 grid (729 points) — only Flag 3 triggers.
• 2000+ random samples in {0, 0.1, …, 1.0}6 — no other THM{…} response.
• Each single slot at 0.46 with all 32 binary patterns of the other five features — only the known Flag 3 trigger fires.
• Each pair of slots at 0.46/0.5 with all 16 binary patterns of the other four — nothing.
• Fine sweep of f2 with the Flag-3 bit pattern — reveals only the three-band behaviour above.
• Verbose/debug field probing on /predict body, header tricks (X-Debug, Authorization, X-Reveal-Flag), submission-style POSTs to /reset ({"feature":2,"threshold":0.45} etc.) — no change in response.
• Endpoint enumeration (/admin, /debug, /info, /v1/*, …) — only /predict, /reset, /static/* respond.

Lessons learned (so far)

• Model extraction is a measurement task first. Before attempting any specific attack class, characterise the model's apparent decision rule from many queries. Here, a binary-corner sweep plus one-feature-at-a-time variation immediately reveals that only Route Risk > 0.45 matters under "normal" inputs.
• A degenerate model is still hiding something. The apparent rule is single-feature thresholding, but the documented response space includes medium and critical bands that none of the obvious inputs reach. That gap is the leak — and the trigger lives in the non-binary interior of the cube, not on the corners.
• Don't filter by what looks interesting — filter by the flag shape. The fastest way to find a honey-response is a brute scan that ignores the classification labels and only watches for THM{…} in any output position. That cut the search from hundreds of hypotheses to one direct hit.
• Honey-class hides where the linear sweeps don't go. The trigger needed five binary positions and Route Risk in a specific narrow window. A pure binary sweep misses it; a pure single-feature sweep misses it; only the combined grid finds it.

Artifacts

• challenge.png — room briefing
• wanted-flags.png — flag-format spec
• web-5000-1-cargomindV2.png — CargoMind v2 UI
• flag-3.png — Flag 3 captured in the UI