You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

This repository contains a deliberately malicious .keras model published for authorized security research / coordinated disclosure (huntr / ProtectAI). Access is gated and manually reviewed. Do not load this model on any system you care about.

⚠️ Security PoC — malicious `.keras` model (do not load casually)

Deliberately malicious Keras 3 model for coordinated vulnerability disclosure.

What it demonstrates

Arbitrary code execution at keras.saving.load_model() time via a TorchModuleWrapper layer whose module field carries a torch.save() archive. TorchModuleWrapper.from_config() calls torch.load() without weights_only=True, executing an attacker pickle gadget during deserialization — even with safe_mode=True. (CVE-2025-49655 class; Keras 3.11.0–3.11.2, torch backend.)
ModelScan bypass. ModelScan's KerasLambdaDetectScan only flags class_name == "Lambda". A TorchModuleWrapper payload in the same config.json returns "No issues found" — a confirmed false negative.

Target format

.keras v3 archive (ZIP): config.json + model.weights.h5 + metadata.json. The payload lives in config.json.

Reproduce

pip install "keras==3.11.2" torch modelscan h5py
export KERAS_BACKEND=torch

# 1) scanner is blind to it
modelscan -p malicious_model.keras        # -> No issues found 🎉

# 2) code executes at load time, safe_mode notwithstanding
python -c "import keras; keras.saving.load_model('malicious_model.keras', safe_mode=True)"
# -> the payload's shell command runs live during the load

build_poc.py is the generator. The payload is a benign id/hostname/uname banner printed to stdout — swap the command in MaliciousPayload.__reduce__ to verify impact in a sandbox.

Evidence

1. ModelScan bypass — the malicious model returns "No issues found", while the Lambda control in the same format is flagged MEDIUM:

2. Arbitrary code execution at load time — the payload's shell command runs live inside load_model(safe_mode=True); the id/hostname/uname output is produced by the model load itself (no file read):

Downloads last month: -

Inference Providers NEW