Kanisia/hdf5-external-file-write-modelscan-bypass

HDF5 External Dataset File Write ModelScan Bypass

Target

HDF5 model format.

Summary

hdf5_external_file_write.h5 is a small HDF5 file containing a dataset whose storage is backed by an external file path. The dataset metadata points to external_written.bin.

When downstream tooling opens the HDF5 file in write mode and writes to the dataset, HDF5 creates/writes the external file path referenced in the model metadata. ModelScan reports no issues and skips the file because it does not find a Keras model config.

Files

• hdf5_external_file_write.h5: PoC model file to upload to Hugging Face.
• external_written.bin: Output fixture created by the verification run.
• build_and_verify.py: Builds the HDF5 file and verifies metadata, external-file write behavior, and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-hdf5-external-file-write\build_and_verify.py

Expected result:

• HDF5 model size is 6144 bytes.
• dataset weights has shape [32].
• dataset external storage metadata is ["external_written.bin", 0, 32].
• writing h5["weights"][:] creates/writes external_written.bin.
• external_written.bin contains HDF5_EXTERNAL_FILE_WRITE_MARKER!.
• ModelScan reports no issues and skips the file as MODEL_CONFIG not found.

Impact

An attacker can publish an HDF5 model artifact that references external local file paths through HDF5 external dataset storage. Downstream tooling that opens the file in write/update mode and writes datasets can be caused to create or overwrite bytes at paths named in the model metadata. Scanners should surface external storage references before model loading or dataset access.