This repository contains a proof of concept for a scanner bypass in .keras model files.
Vulnerability
The open-source protectai/modelscan Keras Lambda detection logic only inspects the first-level config.layers list from a .keras model's config.json. It does not recursively inspect nested model configs such as an inner Sequential.
This means a malicious model can hide a real serialized Lambda layer inside a nested model while keeping the top-level layer list apparently benign. Keras still recognizes the nested Lambda as unsafe and, with safe_mode=False, still executes it during load.
Primary PoC
The main PoC file is:
artifacts/nested_lambda.keras
The payload is harmless. When loaded unsafely, it writes a local marker file at:
