Hugging Face's logo

manja316
/
modelscan-nested-lambda-rce

Keras
security-research
modelscan-bypass
Model card Files
xet
 Community
How to use from the
Use from the
Keras library
# Gated model: Login with a HF token with gated access permission
hf auth login
# !pip install -U keras tensorflow huggingface_hub
# Keras needs TensorFlow installed to read "hf://" paths, so the tensorflow backend is selected here;
# "jax" and "torch" also work for computation once TensorFlow is installed.
import os
os.environ["KERAS_BACKEND"] = "tensorflow"

import keras

model = keras.saving.load_model("hf://manja316/modelscan-nested-lambda-rce")

You need to agree to share your Hugging Face information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Log in or Sign Up to review the conditions and access this model content.

Security Research — Keras Nested Lambda Scanner Bypass

This model is for authorized security research only.

This repository demonstrates a vulnerability in ProtectAI's modelscan scanner (v0.8.8) where Lambda layers nested inside Functional or Sequential submodels evade detection.

Vulnerability

modelscan checks top-level config.layers for class_name == "Lambda" but does not recurse into nested submodel configurations. A malicious Lambda layer inside a nested Functional model passes scanning with "No issues found" but executes arbitrary code on keras.models.load_model().

Affected

  • modelscan <= 0.8.8
  • Both .keras and .h5 format
  • Both Functional and Sequential nesting

Disclosure

Responsible disclosure via Huntr MFV program.

Downloads last month
-
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support