celvexgroup/modelscan-keras-nested-lambda-bypass-poc

modelscan — nested Keras Lambda detection bypass (benign PoC)

Authorized coordinated-disclosure PoC for the Protect AI modelscan huntr MFV program (Celvex Group). Benign marker only — no weaponized payload.

What it is

nested_k2.h5 is a Keras model that contains a Lambda layer nested one level below the top-level layers[] array (inside an inner Functional submodel). modelscan's Lambda detectors (KerasLambdaDetectScan / H5LambdaDetectScan) enumerate only the top-level layers[] with a flat, non-recursive walk, so the nested Lambda is never inspected.

Result (validated vs modelscan 0.8.8)

• nested_k2.h5 → 0 issues (scans clean — BYPASS)
• the same Lambda placed at the top level → 1 issue (FLAGGED) — proving the nesting is what evades, and that modelscan itself treats this construct as dangerous.

Execution

Under the Keras 2 API (tf_keras) or keras 3 with safe_mode=False, the nested Lambda's Python function is reconstructed and invoked on the default load_model() path — the same load condition under which modelscan flags a top-level Lambda.

Benign: the Lambda body only writes an empty marker file. It contains no harmful code.

Fix

Recurse into nested submodels (config.layers) and layer wrappers (config.layer) when enumerating Lambda layers, in both KerasLambdaDetectScan and H5LambdaDetectScan.