Upload 2 files

README.md

@@ -0,0 +1,18 @@
+# modelscan — nested Keras `Lambda` detection bypass (benign PoC)
+
+Authorized coordinated-disclosure PoC for the Protect AI **modelscan** huntr MFV program (Celvex Group). Benign marker only — no weaponized payload.
+
+## What it is
+`nested_k2.h5` is a Keras model that contains a `Lambda` layer nested **one level below** the top-level `layers[]` array (inside an inner Functional submodel). modelscan's Lambda detectors (`KerasLambdaDetectScan` / `H5LambdaDetectScan`) enumerate only the top-level `layers[]` with a **flat, non-recursive** walk, so the nested `Lambda` is never inspected.
+
+## Result (validated vs modelscan 0.8.8)
+- `nested_k2.h5` → **0 issues (scans clean — BYPASS)**
+- the **same** `Lambda` placed at the **top level** → **1 issue (FLAGGED)** — proving the nesting is what evades, and that modelscan itself treats this construct as dangerous.
+
+## Execution
+Under the Keras 2 API (`tf_keras`) or keras 3 with `safe_mode=False`, the nested `Lambda`'s Python function is reconstructed and invoked on the default `load_model()` path — the same load condition under which modelscan flags a top-level `Lambda`.
+
+**Benign:** the `Lambda` body only writes an empty marker file. It contains no harmful code.
+
+## Fix
+Recurse into nested submodels (`config.layers`) and layer wrappers (`config.layer`) when enumerating `Lambda` layers, in both `KerasLambdaDetectScan` and `H5LambdaDetectScan`.

nested_k2.h5

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:978e9ffc25430e024a63bbc09f41bec20a8c7cd32fa703c852d0d652a40138b1
+size 9224