/tmp/huntr_mfv_pwned*).
No reverse shells, no credential theft payloads.| Field | Value |
|---|---|
| Platform | huntr.com MFV |
| Target format | Keras Native (.keras) |
| Scanner under test | Protect AI ModelScan (+ Hub Protect AI panel) |
| Repo | tld8386/huntr-mfv-keras-modelscan-bypass-poc (private) |
| Generated | 2026-07-21 UTC |
A2_top_level_lambda_bytecode.kerasB2_nested_lambda_bytecode.kerasD_torch_module_wrapper.keras| File | Role | ModelScan 0.8.8 (local) |
|---|---|---|
A2_top_level_lambda_bytecode.keras | Control top-level Lambda | MEDIUM (detect) |
B2_nested_lambda_bytecode.keras | Nested Lambda bypass | CLEAN (false negative) |
C2_deep_nested_lambda_bytecode.keras | Deep nested Lambda | CLEAN |
D_torch_module_wrapper.keras | TorchModuleWrapper pickle | CLEAN |
Z_benign.keras | Benign control | CLEAN |
1pip install 'modelscan[h5py]' tensorflow
2modelscan -p A2_top_level_lambda_bytecode.keras # expect MEDIUM Lambda
3modelscan -p B2_nested_lambda_bytecode.keras # expect No issues1import pathlib
2import numpy as np
3from keras import models
4
5marker = pathlib.Path("/tmp/huntr_mfv_pwned")
6marker.unlink(missing_ok=True)
7
8# Requires safe_mode=False (Keras 3.x default True blocks Lambda bytecode)
9m = models.load_model("B2_nested_lambda_bytecode.keras", safe_mode=False)
10m.predict(np.zeros((1, 4), dtype="float32"), verbose=0)
11print(marker.read_text()) # "pwned"safe_mode=True refuses these Lambda models.
The security claim is scanner false negative for models that remain
weaponizable on documented unsafe-load paths./tmp/huntr_mfv_*