Kanisia/hdf5-external-file-read-modelscan-bypass

HDF5 External Dataset File Read ModelScan Bypass

Target

HDF5 model format.

Summary

hdf5_external_file_read.h5 is a small HDF5 file containing a dataset whose storage is backed by an external file path. The dataset metadata points to secret.txt, and reading the dataset with h5py causes HDF5 to read bytes from that external file.

The PoC demonstrates that a model file can carry an external storage reference which is not surfaced by ModelScan. ModelScan reports no issues and skips the file because it does not find a Keras model config.

Files

• hdf5_external_file_read.h5: PoC model file to upload to Hugging Face.
• secret.txt: Reproduction fixture read through the HDF5 external dataset.
• build_and_verify.py: Builds the HDF5 file and verifies metadata, external-file read behavior, and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-hdf5-external-file-read\build_and_verify.py

Expected result:

• HDF5 model size is 6144 bytes.
• dataset weights has shape [32].
• dataset external storage metadata is ["secret.txt", 0, 32].
• reading h5["weights"][:] returns HDF5_EXTERNAL_FILE_READ_MARKER.
• ModelScan reports no issues and skips the file as MODEL_CONFIG not found.

Impact

An attacker can publish an HDF5 model artifact that references external local files through HDF5 external dataset storage. Downstream tooling that reads datasets from the model can be caused to read bytes from paths named in the model metadata. Scanners should surface external storage references before model loading or dataset access.