hacnho/keras-quantization-activation-epsilon-poc

Keras quantization_config activation quantizer PoC

This repository contains a benign security research proof of concept for a Keras Native .keras model-file output-manipulation issue.

Files:

• control_quantized_dense.keras
• malicious_quantized_activation_epsilon.keras
• reproduce.py

The malicious behavior is encoded in config.json inside the .keras archive. The control model is a quantized identity Dense layer. The malicious model changes quantization_config.config.activation_quantizer.config.epsilon from 1e-07 to 1000000000.0.

Tested versions:

• keras==3.15.0
• tensorflow-cpu==2.19.0
• modelscan==0.8.8

Reproduction:

python3 -m venv /tmp/keras-quant-poc
. /tmp/keras-quant-poc/bin/activate
pip install keras==3.15.0 tensorflow-cpu==2.19.0 numpy==1.26.4 modelscan==0.8.8
python reproduce.py control_quantized_dense.keras malicious_quantized_activation_epsilon.keras
modelscan -p malicious_quantized_activation_epsilon.keras

Expected result:

• the control artifact returns non-zero identity-like outputs for the fixed numeric batch
• the malicious artifact returns all zeros with the same output shape
• keras.saving.load_model(..., safe_mode=True) is used
• modelscan==0.8.8 reports No issues found

Public file URLs:

• https://huggingface.co/hacnho/keras-quantization-activation-epsilon-poc/resolve/main/control_quantized_dense.keras
• https://huggingface.co/hacnho/keras-quantization-activation-epsilon-poc/resolve/main/malicious_quantized_activation_epsilon.keras
• https://huggingface.co/hacnho/keras-quantization-activation-epsilon-poc/resolve/main/reproduce.py