You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

Keras TorchModuleWrapper.from_config Safe Mode Bypass

This PoC demonstrates arbitrary command execution through keras.layers.TorchModuleWrapper.from_config() in Keras 3.14.1.

TorchModuleWrapper.from_config() deserializes a base64-encoded PyTorch pickle with torch.load(..., weights_only=False). The guard checks only in_safe_mode(). When from_config() is called directly outside an ambient SafeModeScope, in_safe_mode() returns None, the guard does not raise, and the attacker-controlled pickle executes.

The control path through keras.layers.deserialize() is blocked by the ambient safe-mode scope, confirming that the issue is the direct from_config() guard behavior.

Files

torchmodulewrapper_config.json - crafted Keras layer config containing a base64 PyTorch pickle payload.
build_and_verify.py - builds the crafted config and verifies the behavior.
verify_report.json - local verification output.

Reproduction

Run:

python build_and_verify.py

Expected results:

Direct call to TorchModuleWrapper.from_config(config) creates direct_from_config_marker.txt.
keras.layers.deserialize(config) blocks with a ValueError mentioning torch.load.
The control marker for keras.layers.deserialize() is not created.

Impact

Any application that accepts a Keras TorchModuleWrapper layer config and calls TorchModuleWrapper.from_config(config) directly can execute attacker-controlled pickle payloads through torch.load(..., weights_only=False) without explicitly disabling safe mode.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support