# modelscan — nested Keras `Lambda` detection bypass (benign PoC)

Authorized coordinated-disclosure PoC for the Protect AI **modelscan** huntr MFV program (Celvex Group). Benign marker only — no weaponized payload.

## What it is
`nested_k2.h5` is a Keras model that contains a `Lambda` layer nested **one level below** the top-level `layers[]` array (inside an inner Functional submodel). modelscan's Lambda detectors (`KerasLambdaDetectScan` / `H5LambdaDetectScan`) enumerate only the top-level `layers[]` with a **flat, non-recursive** walk, so the nested `Lambda` is never inspected.

## Result (validated vs modelscan 0.8.8)
- `nested_k2.h5` → **0 issues (scans clean — BYPASS)**
- the **same** `Lambda` placed at the **top level** → **1 issue (FLAGGED)** — proving the nesting is what evades, and that modelscan itself treats this construct as dangerous.

## Execution
Under the Keras 2 API (`tf_keras`) or keras 3 with `safe_mode=False`, the nested `Lambda`'s Python function is reconstructed and invoked on the default `load_model()` path — the same load condition under which modelscan flags a top-level `Lambda`.

**Benign:** the `Lambda` body only writes an empty marker file. It contains no harmful code.

## Fix
Recurse into nested submodels (`config.layers`) and layer wrappers (`config.layer`) when enumerating `Lambda` layers, in both `KerasLambdaDetectScan` and `H5LambdaDetectScan`.