manbearpig-mb/h5-nested-lambda-scanner-bypass

ModelScan H5LambdaDetectScan Bypass via Nested Lambda Layers

Security research artifact. Do not use in production.

ModelScan v0.8.8's H5LambdaDetectScan only checks top-level layers in model_config JSON for Lambda layers. Keras recursively deserializes nested model structures. A Lambda layer hidden inside a nested Sequential sub-model, wrapper layer (TimeDistributed, Bidirectional), or training_config completely bypasses detection while executing arbitrary code on keras.models.load_model().

Files

• poc_nested_sequential.h5 - Lambda inside nested Sequential (bypasses scanner)
• poc_timedistributed.h5 - Lambda inside TimeDistributed wrapper (bypasses scanner)
• poc_bidirectional.h5 - Lambda inside Bidirectional wrapper (bypasses scanner)
• poc_stealth_nlp.h5 - Lambda inside Functional model with nested Sequential (bypasses scanner)
• poc_training_loss.h5 - Payload hidden in training_config loss (bypasses scanner)
• poc_baseline_detected.h5 - Lambda at top level (detected by scanner, used as control)
• poc_h5_nested_lambda_bypass.py - Generator script for all variants
• verify_h5_rce.py - End-to-end RCE verification (simulates Keras 3.8.0 deserialization)

Quick Verification

pip install modelscan h5py numpy

# Scanner bypass (reports clean on malicious file):
modelscan --path poc_nested_sequential.h5
# Output: "No issues found"

# Scanner detects flat control:
modelscan --path poc_baseline_detected.h5
# Output: "Unsafe operator found... Lambda"

# Verify code execution:
python3 verify_h5_rce.py
# Output: "[RCE CONFIRMED] /tmp/h5_rce_proof exists!"