hacnho/keras-compile-boston-learning-rate-callback-poc

Keras Compile Config Learning Rate Callback PoC

This repository contains a benign security research PoC for a Keras Native .keras artifact whose compile_config.optimizer.config.learning_rate field is patched to the exported built-in callback keras.datasets.boston_housing.load_data.

Files

• control_sgd_lr_float.keras Control artifact with a normal float learning rate.
• malicious_sgd_lr_boston_load_data.keras Patched artifact with a callable learning-rate config.
• reproduce.py Loads the artifact, then runs a benign fit() to trigger the callback.
• requirements.txt Tested package versions.

Tested Environment

• keras==3.15.0
• tensorflow-cpu==2.19.0
• modelscan==0.8.8
• numpy==1.26.4
• scipy==1.15.3

Trigger

The artifact itself loads cleanly with:

keras.saving.load_model(path, safe_mode=True)

The side effect is triggered by a later benign training call:

loaded.fit(np.array([[1.0]]), np.array([[1.0]]), epochs=1)

Observable Side Effect

On a fresh KERAS_HOME, the first benign fit() creates:

datasets/boston_housing.npz

before training fails because the learning-rate callback returns a dataset tuple instead of a scalar.

Scanner Result

modelscan==0.8.8 reports:

No issues found!

Reproduction

python3 -m venv /tmp/keras-compile-lr
/tmp/keras-compile-lr/bin/pip install -U pip
/tmp/keras-compile-lr/bin/pip install -r requirements.txt
export KERAS_HOME=/tmp/keras-compile-lr-home
export KERAS_BACKEND=tensorflow
/tmp/keras-compile-lr/bin/python reproduce.py malicious_sgd_lr_boston_load_data.keras