Upload folder using huggingface_hub

README.md

@@ -0,0 +1,89 @@
+---
+library_name: keras
+tags:
+- security
+- keras
+- modelscan
+- proof-of-concept
+license: apache-2.0
+---
+
+# Keras Native Non-Layer Lambda ModelScan Bypass PoC
+
+Benign security proof-of-concept for a ModelScan Keras Native scanner/runtime mismatch.
+
+## Summary
+
+ModelScan 0.8.8 flags top-level Keras `Lambda` layers, but it misses marshalled Python `__lambda__` bytecode stored in other `.keras` native `config.json` fields. Keras 3.14.1 blocks these artifacts by default with `safe_mode=True`. If a workflow opts into unsafe deserialization with `safe_mode=False`, Keras consumes the artifact-carried lambda and executes benign marker code.
+
+This repository contains three variants of the same scanner weakness:
+
+1. `Dense.activation` contains `class_name: "__lambda__"`.
+2. `keras.ops.map` contains an inbound-node lambda argument.
+3. `keras.ops.vectorized_map` contains a lambda in the operation config.
+
+ModelScan reports zero issues for all three `.keras` archives.
+
+## Severity
+
+Medium, CVSS 5.3.
+
+Rationale: the impact is a scanner false negative for artifact-carried Python bytecode that can execute during unsafe Keras deserialization. The severity is capped because this is not a default Keras `safe_mode=True` bypass.
+
+## Tested Versions
+
+- `keras==3.14.1`
+- `tensorflow==2.20.0`
+- `modelscan==0.8.8`
+- `h5py==3.16.0`
+- Python 3.12.3
+
+## Files
+
+- `variants/activation/activation_lambda_manual_config.keras`
+- `variants/ops_map/ops_map_inbound_lambda.keras`
+- `variants/vectorized_map/vectorized_map_lambda.keras`
+- `verify_all.py`: verifies safe-mode blocking, unsafe marker execution, lambda locations, and ModelScan output.
+- `results/`: captured local validation outputs.
+- `requirements.txt`: tested dependency versions.
+
+## Reproduce
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+pip install -r requirements.txt
+
+python verify_all.py
+```
+
+Expected result:
+
+- `safe_mode_true` starts with `blocked:` for all variants.
+- `marker_after_safe_mode_true` is `false` for all variants.
+- unsafe deserialization creates the expected benign marker for all variants.
+- `modelscan_total_issues` is `0` for all variants.
+- `all_passed` is `true`.
+
+## Artifact Hashes
+
+```text
+f43f6dd253cb5f4683a2903ea5b6d7ae744573c7f4fbdb82d584974709ee3be8  variants/activation/activation_lambda_manual_config.keras
+2a900cb614d5e0b6eef831e0bd4caafc6503daf6d33963ec6a64f7fa447d6cdc  variants/ops_map/ops_map_inbound_lambda.keras
+536334212fdea8cf9a19cf71d0c4decd74442116eb31ee39aab0c9d28b13757e  variants/vectorized_map/vectorized_map_lambda.keras
+```
+
+## Impact
+
+A registry or deployment workflow can scan a `.keras` artifact with ModelScan, receive a clean result, and later execute artifact-carried Python bytecode if it loads the model with unsafe Keras deserialization enabled. The PoC keeps the effect benign by writing local marker files only.
+
+## Limitations
+
+- Not a Keras default safe-mode bypass.
+- Requires `safe_mode=False` or equivalent unsafe deserialization opt-in.
+- Does not execute shell commands, access credentials, persist, or perform network activity.
+- Related public work exists for top-level/wrapped Lambda misses and HDF5 activation-field bypasses; this PoC demonstrates current Keras native `.keras` non-layer `__lambda__` fields.
+
+## Suggested Mitigation
+
+ModelScan's Keras Native scanner should recursively inspect `config.json` for `class_name: "__lambda__"` and other unsafe deserialization markers, not only top-level layers whose `class_name` is `Lambda`.

requirements.txt

@@ -0,0 +1,5 @@
+keras==3.14.1
+tensorflow==2.20.0
+modelscan==0.8.8
+h5py==3.16.0
+numpy==2.3.4

results/activation_modelscan_results.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "activation_lambda_manual_config.keras", "absolute_path": "/workspace/keras_native/hf_keras_native_activation_lambda_poc", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T13:18:10.152015", "scanned": {"total_scanned": 1, "scanned_files": ["activation_lambda_manual_config.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "activation_lambda_manual_config.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "activation_lambda_manual_config.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "activation_lambda_manual_config.keras:model.weights.h5"}]}}, "issues": [], "errors": []}

results/activation_runtime_results.txt

@@ -0,0 +1,13 @@
+keras_version=3.14.1
+artifact=/workspace/keras_native/hf_keras_native_activation_lambda_poc/activation_lambda_manual_config.keras
+working_directory=/workspace/keras_native/hf_keras_native_activation_lambda_poc
+config_summary={"activation_class": "__lambda__", "activation_has_marshaled_value": false, "activation_keys": ["class_name", "config"], "has_top_level_lambda_layer": false, "layer_class": "Dense"}
+safe_mode_true=blocked:TypeError:<class 'keras.src.models.sequential.Sequential'> could not be deserialized properly. Please ensure that components that are Python object instances (layers, models, etc.) returned by `get_config()` are explicitly deserialized in the model's `from_config()` method.
+marker_after_safe_mode_true=False
+marker_after_safe_mode_false_load=False
+marker_after_safe_mode_false_infer=True
+marker_content=KERAS_NATIVE_ACTIVATION_LAMBDA_MARKER
+modelscan_returncode=0
+modelscan_summary={}
+modelscan_issues=[]
+modelscan_errors=[]

results/ops_map_modelscan_results.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "/workspace/keras_native/hf_keras_native_ops_map_poc/ops_map_inbound_lambda.keras", "absolute_path": "/workspace/keras_native/hf_keras_native_ops_map_poc", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T14:01:04.593668", "scanned": {"total_scanned": 1, "scanned_files": ["ops_map_inbound_lambda.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "ops_map_inbound_lambda.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "ops_map_inbound_lambda.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "ops_map_inbound_lambda.keras:model.weights.h5"}]}}, "issues": [], "errors": []}

results/ops_map_runtime_results.json

@@ -0,0 +1,39 @@
+{
+  "artifact": "/workspace/keras_native/hf_keras_native_ops_map_poc/ops_map_inbound_lambda.keras",
+  "keras_version": "3.14.1",
+  "lambda_paths": [
+    "$.config.layers[1].inbound_nodes[0].args[0]"
+  ],
+  "marker_after_safe_mode_false_load": true,
+  "marker_after_safe_mode_false_load_content": "OPS_MAP_MARKER",
+  "marker_after_safe_mode_true": false,
+  "marker_after_unsafe_inference": true,
+  "modelscan_issues": [],
+  "modelscan_returncode": 0,
+  "modelscan_skipped": {
+    "skipped_files": [
+      {
+        "category": "SCAN_NOT_SUPPORTED",
+        "description": "Model Scan did not scan file",
+        "source": "ops_map_inbound_lambda.keras:metadata.json"
+      },
+      {
+        "category": "SCAN_NOT_SUPPORTED",
+        "description": "Model Scan did not scan file",
+        "source": "ops_map_inbound_lambda.keras:config.json"
+      },
+      {
+        "category": "MODEL_CONFIG",
+        "description": "Model Config not found",
+        "source": "ops_map_inbound_lambda.keras:model.weights.h5"
+      }
+    ],
+    "total_skipped": 3
+  },
+  "modelscan_total_issues": 0,
+  "modelscan_version": "0.8.8",
+  "safe_mode_false_load": "loaded",
+  "safe_mode_true": "blocked:ValueError:Requested the deserialization of a Python lambda. This carries a potential risk of arbitrary code execution and thus it is disallowed by default. If you trust the source of the artifact, you can override this error by passing `safe_mode=False` to the loading function, or calling `keras.config.enable_unsafe_deserialization().",
+  "sha256": "2a900cb614d5e0b6eef831e0bd4caafc6503daf6d33963ec6a64f7fa447d6cdc",
+  "unsafe_inference": "ok"
+}

results/vectorized_map_modelscan_results.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "/workspace/keras_native/hf_keras_native_vectorized_map_poc/vectorized_map_lambda.keras", "absolute_path": "/workspace/keras_native/hf_keras_native_vectorized_map_poc", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T14:01:42.382025", "scanned": {"total_scanned": 1, "scanned_files": ["vectorized_map_lambda.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "vectorized_map_lambda.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "vectorized_map_lambda.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "vectorized_map_lambda.keras:model.weights.h5"}]}}, "issues": [], "errors": []}

results/vectorized_map_runtime_results.json

@@ -0,0 +1,39 @@
+{
+  "artifact": "/workspace/keras_native/hf_keras_native_vectorized_map_poc/vectorized_map_lambda.keras",
+  "keras_version": "3.14.1",
+  "lambda_paths": [
+    "$.config.layers[1].config.function"
+  ],
+  "marker_after_safe_mode_false_load": true,
+  "marker_after_safe_mode_false_load_content": "VECTORIZED_MAP_MARKER",
+  "marker_after_safe_mode_true": false,
+  "marker_after_unsafe_inference": true,
+  "modelscan_issues": [],
+  "modelscan_returncode": 0,
+  "modelscan_skipped": {
+    "skipped_files": [
+      {
+        "category": "SCAN_NOT_SUPPORTED",
+        "description": "Model Scan did not scan file",
+        "source": "vectorized_map_lambda.keras:metadata.json"
+      },
+      {
+        "category": "SCAN_NOT_SUPPORTED",
+        "description": "Model Scan did not scan file",
+        "source": "vectorized_map_lambda.keras:config.json"
+      },
+      {
+        "category": "MODEL_CONFIG",
+        "description": "Model Config not found",
+        "source": "vectorized_map_lambda.keras:model.weights.h5"
+      }
+    ],
+    "total_skipped": 3
+  },
+  "modelscan_total_issues": 0,
+  "modelscan_version": "0.8.8",
+  "safe_mode_false_load": "loaded",
+  "safe_mode_true": "blocked:ValueError:Requested the deserialization of a Python lambda. This carries a potential risk of arbitrary code execution and thus it is disallowed by default. If you trust the source of the artifact, you can override this error by passing `safe_mode=False` to the loading function, or calling `keras.config.enable_unsafe_deserialization().",
+  "sha256": "536334212fdea8cf9a19cf71d0c4decd74442116eb31ee39aab0c9d28b13757e",
+  "unsafe_inference": "ok"
+}

variants/activation/activation_lambda_manual_config.modelscan.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "/workspace/keras_native/hf_keras_native_nonlayer_lambda_poc/variants/activation/activation_lambda_manual_config.keras", "absolute_path": "/workspace/keras_native/hf_keras_native_nonlayer_lambda_poc/variants/activation", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T15:24:59.629625", "scanned": {"total_scanned": 1, "scanned_files": ["activation_lambda_manual_config.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "activation_lambda_manual_config.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "activation_lambda_manual_config.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "activation_lambda_manual_config.keras:model.weights.h5"}]}}, "issues": [], "errors": []}

variants/ops_map/ops_map_inbound_lambda.modelscan.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "/workspace/keras_native/hf_keras_native_nonlayer_lambda_poc/variants/ops_map/ops_map_inbound_lambda.keras", "absolute_path": "/workspace/keras_native/hf_keras_native_nonlayer_lambda_poc/variants/ops_map", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T15:25:16.819075", "scanned": {"total_scanned": 1, "scanned_files": ["ops_map_inbound_lambda.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "ops_map_inbound_lambda.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "ops_map_inbound_lambda.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "ops_map_inbound_lambda.keras:model.weights.h5"}]}}, "issues": [], "errors": []}

variants/vectorized_map/vectorized_map_lambda.modelscan.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "/workspace/keras_native/hf_keras_native_nonlayer_lambda_poc/variants/vectorized_map/vectorized_map_lambda.keras", "absolute_path": "/workspace/keras_native/hf_keras_native_nonlayer_lambda_poc/variants/vectorized_map", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T15:25:32.378590", "scanned": {"total_scanned": 1, "scanned_files": ["vectorized_map_lambda.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "vectorized_map_lambda.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "vectorized_map_lambda.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "vectorized_map_lambda.keras:model.weights.h5"}]}}, "issues": [], "errors": []}

verify_all.py

@@ -0,0 +1,167 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import subprocess
+import sys
+import zipfile
+from pathlib import Path
+
+os.environ.setdefault("KERAS_BACKEND", "tensorflow")
+os.environ.setdefault("TF_CPP_MIN_LOG_LEVEL", "2")
+
+import keras
+import numpy as np
+
+
+ROOT = Path(__file__).resolve().parent
+
+VARIANTS = [
+    {
+        "name": "activation",
+        "artifact": ROOT / "variants" / "activation" / "activation_lambda_manual_config.keras",
+        "marker": ROOT / "variants" / "activation" / "activation_lambda_marker.txt",
+        "expected_marker": "KERAS_NATIVE_ACTIVATION_LAMBDA_MARKER",
+        "inference_input": np.array([[2.0]], dtype="float32"),
+    },
+    {
+        "name": "ops_map",
+        "artifact": ROOT / "variants" / "ops_map" / "ops_map_inbound_lambda.keras",
+        "marker": ROOT / "variants" / "ops_map" / "ops_map_marker.txt",
+        "expected_marker": "OPS_MAP_MARKER",
+        "inference_input": np.ones((1, 2, 1), dtype="float32"),
+    },
+    {
+        "name": "vectorized_map",
+        "artifact": ROOT / "variants" / "vectorized_map" / "vectorized_map_lambda.keras",
+        "marker": ROOT / "variants" / "vectorized_map" / "vectorized_map_marker.txt",
+        "expected_marker": "VECTORIZED_MAP_MARKER",
+        "inference_input": np.ones((1, 2, 1), dtype="float32"),
+    },
+]
+
+
+def sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def lambda_paths(path: Path) -> list[str]:
+    with zipfile.ZipFile(path) as zf:
+        config = json.loads(zf.read("config.json"))
+    hits: list[str] = []
+
+    def walk(value, trail: str = "$") -> None:
+        if isinstance(value, dict):
+            if value.get("class_name") == "__lambda__":
+                hits.append(trail)
+            for key, child in value.items():
+                walk(child, f"{trail}.{key}")
+        elif isinstance(value, list):
+            for index, child in enumerate(value):
+                walk(child, f"{trail}[{index}]")
+
+    walk(config)
+    return hits
+
+
+def run_modelscan(artifact: Path) -> dict[str, object]:
+    output_path = artifact.with_name(f"{artifact.stem}.modelscan.json")
+    output_path.unlink(missing_ok=True)
+    proc = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "modelscan.cli",
+            "-p",
+            str(artifact),
+            "-r",
+            "json",
+            "-o",
+            str(output_path),
+            "--show-skipped",
+        ],
+        text=True,
+        capture_output=True,
+        check=False,
+        timeout=60,
+    )
+    parsed: dict[str, object]
+    try:
+        parsed = json.loads(output_path.read_text())
+    except (json.JSONDecodeError, FileNotFoundError):
+        parsed = {"stdout": proc.stdout, "stderr": proc.stderr}
+    parsed["_returncode"] = proc.returncode
+    parsed["_stderr"] = proc.stderr
+    return parsed
+
+
+def verify_variant(variant: dict[str, object]) -> dict[str, object]:
+    artifact = Path(variant["artifact"])
+    marker = Path(variant["marker"])
+    expected_marker = str(variant["expected_marker"])
+    inference_input = variant["inference_input"]
+
+    marker.unlink(missing_ok=True)
+    old_cwd = Path.cwd()
+    os.chdir(artifact.parent)
+    try:
+        result: dict[str, object] = {
+            "name": variant["name"],
+            "artifact": str(artifact.relative_to(ROOT)),
+            "sha256": sha256(artifact),
+            "lambda_paths": lambda_paths(artifact),
+        }
+
+        try:
+            keras.saving.load_model(artifact, safe_mode=True)
+            result["safe_mode_true"] = "loaded_unexpectedly"
+        except Exception as exc:  # noqa: BLE001
+            result["safe_mode_true"] = (
+                f"blocked:{type(exc).__name__}:{str(exc).splitlines()[0]}"
+            )
+        result["marker_after_safe_mode_true"] = marker.exists()
+
+        marker.unlink(missing_ok=True)
+        model = keras.saving.load_model(artifact, safe_mode=False)
+        result["marker_after_safe_mode_false_load"] = marker.exists()
+        if not marker.exists():
+            model(inference_input)
+        result["marker_after_unsafe_inference"] = marker.exists()
+        result["marker_content"] = marker.read_text().strip() if marker.exists() else ""
+        result["marker_matched"] = result["marker_content"] == expected_marker
+
+        scan = run_modelscan(artifact)
+        summary = scan.get("summary", {}) if isinstance(scan, dict) else {}
+        result["modelscan_returncode"] = scan.get("_returncode")
+        result["modelscan_version"] = (
+            summary.get("modelscan_version") if isinstance(summary, dict) else None
+        )
+        result["modelscan_total_issues"] = (
+            summary.get("total_issues") if isinstance(summary, dict) else None
+        )
+        result["modelscan_issues"] = scan.get("issues", [])
+        result["passed"] = (
+            str(result["safe_mode_true"]).startswith("blocked:")
+            and result["marker_after_safe_mode_true"] is False
+            and result["marker_matched"] is True
+            and result["modelscan_total_issues"] == 0
+        )
+        return result
+    finally:
+        os.chdir(old_cwd)
+
+
+def main() -> int:
+    results = {
+        "python": sys.version.split()[0],
+        "keras": keras.__version__,
+        "variants": [verify_variant(variant) for variant in VARIANTS],
+    }
+    results["all_passed"] = all(item["passed"] for item in results["variants"])
+    print(json.dumps(results, indent=2, sort_keys=True))
+    return 0 if results["all_passed"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())