# PoC: Keras Lambda Layer ACE

## Vulnerability
Arbitrary Code Execution via Keras Lambda Layer Deserialization

## Format
Keras Native (.keras)

## Impact
- Full system compromise when model loaded with safe_mode=False
- Arbitrary code execution
- Bounty: $3,000-$4,000

## Test
```python
keras.config.enable_unsafe_deserialization()
model = keras.models.load_model('malicious_keras_ace.keras')  # RCE!
```