manbearpig-mb/keras-native-scanner-bypass

ModelScan KerasLambdaDetectScan Bypass — .keras Format (Keras 3 Native)

Security research artifact. Do not use in production.

ModelScan v0.8.8's KerasLambdaDetectScan has two distinct bypass issues for .keras files (Keras 3 native ZIP format):

1. False tensorflow dependency: The scanner inherits handle_binary_dependencies() from SavedModelScan, which requires tensorflow. Without TF (the common case for Keras 3), the scanner never inspects the file — ALL .keras files pass as clean.

2. Non-recursive Lambda detection + lambda in non-Lambda fields: Even with TF, the scanner only checks config.layers[i].class_name == "Lambda" at depth 1. Nested Lambdas and __lambda__ bytecode embedded in other fields (activation, kernel_initializer) are invisible.

Files

• poc_control_top_level.keras - Lambda at top level (control)
• poc_nested_lambda.keras - Lambda inside nested Sequential (bypasses flat check)
• poc_dense_activation_lambda.keras - lambda in Dense activation field (invisible to Lambda-only check)
• poc_kernel_initializer_lambda.keras - lambda in kernel_initializer field
• poc_keras_lambda_bypass.py - Generator script + built-in RCE verification

Reproduction

pip install modelscan h5py numpy

# Generate all variants:
python3 poc_keras_lambda_bypass.py

# Scanner reports clean on ALL variants (tensorflow dependency error):
modelscan --path poc_nested_lambda.keras
# Output: "No issues found" + tensorflow dependency error

modelscan --path poc_dense_activation_lambda.keras
# Output: "No issues found" + tensorflow dependency error

# Even the control (top-level Lambda) passes:
modelscan --path poc_control_top_level.keras
# Output: "No issues found" + tensorflow dependency error