You need to agree to share your Hugging Face information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

pocs/keras-core/ — Running PoC Results

Project: keras-core 0.1.7 (keras-team/keras-core) Author: Cooperate with Dingyu Wang and Jianhe Li Date: 2026-06-22 Backend: TensorFlow 2.15.0 (CPU)

Findings Status

#	Name	API	Status
1	KERASCORE-RCE-01	Legacy H5 `load_model()` Lambda bytecode revival	✅ CONFIRMED
2	KERASCORE-RCE-02	Legacy H5 compile restoration (second deserialization surface)	✅ CONFIRMED
3	KERASCORE-RW-03	`get_file()` zip extraction lacks safety filter	✅ CONFIRMED
4	KERASCORE-RCE-04	`model_from_json()` Lambda bytecode revival	❌ NOT CONFIRMED
5	KERASCORE-RCE-05	`model_from_config()` Lambda bytecode revival	✅ CONFIRMED

Verified Environment

Python 3.11.8
keras-core 0.1.7 (editable install from source)
TensorFlow 2.15.0
h5py 3.16.0
Windows 11 (nt path handling)

Key Finding: RCE-04 Rejected

model_from_json() in keras-core 0.1.7 uses serialization_lib.deserialize_keras_object(), which sets SafeModeScope(True). When Lambda.from_config() is reached through this path, safe_mode is correctly enforced and blocks __lambda__ deserialization.

The report's claim is not validated for this codebase version.

Key Finding: Legacy Path Bypass

The confirmed RCE-01 and RCE-05 findings share a common root cause:

Legacy serialization.deserialize_keras_object() (in legacy/saving/serialization.py) does not set up SafeModeScope
Lambda.from_config() calls serialization_lib.in_safe_mode() which returns None (never initialized by the legacy path)
None is falsy, so the safe_mode guard is bypassed
marshal.loads() is reached via python_utils.func_load()

PoC Files

All PoC files output to C:\Users\user\AppData\Local\Temp/kerascore_rce*_marker.txt. Marker contents confirm code execution at the marshal.loads() sink.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support