You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

Keras Native `safe_mode` Function/Class Confusion PoC

Private, harmless submission-preparation bundle. Do not upload, publish, or submit without explicit approval.

Required layout and precondition

candidate.keras and the complete sibling tf-init-canary directory are one malicious model distribution. Keep them together. Run the load command with this directory as the current working directory so the relative tf-init-canary path resolves.

Exact commands

From this directory:

$envDir = Join-Path $env:TEMP "keras-mfv-final-repro-env"
uv venv --python 3.13 $envDir
$python = Join-Path $envDir "Scripts\python.exe"
$scanner = Join-Path $envDir "Scripts\modelscan.exe"
uv pip install --python $python keras==3.15.0 tensorflow==2.21.0 modelscan==0.8.8 h5py==3.14.0

& $scanner scan -r json -p candidate.keras
& $scanner scan -r json -p .

& $python keras_tfsm_printv2_poc.py run --bundle . --mode candidate
& $python test_keras_tfsm_printv2_poc.py

The environment is deliberately created outside this directory so scanning . covers only the prepared submission folder. Scan before running the candidate. The canary file must be absent before both scans. The candidate load uses safe_mode=True and creates KERAS_MFV_PRINTV2_CANARY.txt containing:

KERAS_MFV_PRINTV2_CANARY_20260729

The model returns [[2.0]] with no load error.

Rebuild

& $python keras_tfsm_printv2_poc.py build --bundle .

Rebuilding replaces only candidate.keras, tf-init-canary, and the canary file in this directory. It does not create or retain a template model.

Scope of the evidence

The demonstrated result is attacker-controlled TensorFlow graph initialization and a fixed-content file write during safe_mode=True model loading.

The scanner result applies only to open-source ModelScan 0.8.8 with its default settings. ProtectAI's private scanner was not accessed or tested.

Downloads last month: -

Inference Providers NEW