You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

MLflow Keras sidecar deserialization PoC

This repository is an authorized security-research proof of concept for MLflow model-format handling.

The visible model file is data/model.keras. The MLmodel metadata routes loading through the legacy mlflow.tensorflow flavor. During load, MLflow checks for data/custom_objects.cloudpickle and deserializes it before Keras model validation/loading completes.

The sidecar payload is benign: it writes /tmp/mlflow_keras_sidecar_poc and returns an empty custom-object dictionary. This demonstrates load-time code execution in an MLflow .keras model artifact layout without performing any harmful action.

Expected local trigger:

import mlflow.pyfunc

mlflow.pyfunc.load_model("PATH_TO_THIS_REPO")

Expected evidence:

/tmp/mlflow_keras_sidecar_poc exists after load

Depending on the local TensorFlow/Keras version, model loading may fail after the marker is written because the included model.keras is intentionally minimal. The security boundary is crossed before that later parser error.

Downloads last month: -

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support