CoolFace
Modelpublic

xiaoyaoes/modelscan-bypass-keras-compile

sourceHugging Faceupdated 3mo agoView on Hugging Face
0likes8downloads
Model Card

ModelScan Keras Archive Blind Spot PoC

The Vulnerability

ModelScan's Keras scanner (KerasLambdaDetectScan) only reads config.json from .keras zip archives and ignores all other files.

Contents

  • —evil_compile.keras - Keras model with malicious compile_config.loss (unscanned)
  • —hidden_pickle.keras - Keras model with embedded pickle payload in non-config.json file

Verification

bash
modelscan -p evil_compile.keras
# → "No issues found" (compile_config contains malicious loss reference)

The scanner at modelscan/scanners/keras/scan.py:_get_keras_operator_names() only checks: model_config_data.get("config", {}).get("layers", {}) for class_name == "Lambda"

It never reads: compileconfig, optimizationconfig, custom_objects, or any other file in the archive.