hacnho/keras-modelscan-plot-gallery-bypass-poc

Keras modelscan non-Lambda file-write bypass PoC

This repository contains a bounded .keras proof of concept for a modelscan 0.8.8 scanner gap. The model contains no Lambda layer. Instead, an unconnected Functional keras.src.ops.core.Switch operation calls the exported Keras API keras.visualization.plot_image_gallery during keras.saving.load_model(..., safe_mode=True).

The modelscan Keras scanner only checks top-level layers[].class_name == "Lambda", so it reports the artifact clean even though a normal Keras load writes /tmp/mfv_keras_plot_gallery_marker.png.

Reproduce

python -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt
python reproduce.py

Expected:

• picklescan exits 0 with Infected files: 0 and Dangerous globals: 0
• modelscan exits 0 with No issues found!
• keras.saving.load_model(..., safe_mode=True) returns Functional
• /tmp/mfv_keras_plot_gallery_marker.png is created

The side effect is limited to a 42x42 PNG marker under /tmp.