hacnho/keras-decode-predictions-poc

Keras decode_predictions dead-node proof of concept

This repository contains a bounded .keras proof of concept for the existing Keras dead Functional-node / NON_MODELING_APIS trust-boundary family.

Primary artifact:

dead_switch_keras_applications_imagenet_utils_decode_predictions.keras

It calls:

keras.applications.imagenet_utils.decode_predictions(...)

during keras.saving.load_model(..., safe_mode=True).

Expected effect

The malicious archive loads successfully, but an isolated KERAS_HOME gains:

models/imagenet_class_index.json

This is a bounded reviewer-friendly side effect:

• no large dataset downloads
• no huge weight file
• no arbitrary path control

Files

• dead_switch_keras_applications_imagenet_utils_decode_predictions.keras
• verify_remote_poc.py
• requirements.txt
• SHA256SUMS.txt

Verify the public artifact

python3 -m venv /tmp/keras-decode-predictions-poc
. /tmp/keras-decode-predictions-poc/bin/activate
pip install --upgrade pip
pip install -r requirements.txt
python verify_remote_poc.py

Expected result:

• load_result = ok:Functional
• dead_function = keras.applications.imagenet_utils.decode_predictions
• new_keras_home_files includes: models/imagenet_class_index.json

Safety note

This is bounded same-family strengthening evidence:

• no ACE claim
• no arbitrary file path control
• intended to support an existing Keras MFV root-cause family, not a fresh report by itself