YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
ModelScan Keras Archive Blind Spot PoC
The Vulnerability
ModelScan's Keras scanner (KerasLambdaDetectScan) only reads config.json from .keras zip archives and ignores all other files.
Contents
evil_compile.keras- Keras model with maliciouscompile_config.loss(unscanned)hidden_pickle.keras- Keras model with embedded pickle payload in non-config.json file
Verification
modelscan -p evil_compile.keras
# → "No issues found" (compile_config contains malicious loss reference)
The scanner at modelscan/scanners/keras/scan.py:_get_keras_operator_names() only checks:
model_config_data.get("config", {}).get("layers", {}) for class_name == "Lambda"
It never reads: compile_config, optimization_config, custom_objects, or any other file in the archive.
- Downloads last month
- 33
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support