__lambda__. When loaded with safe_mode=False, Keras eval()'s the lambda source string, allowing arbitrary code execution.class_name: "Lambda" (capital L, referring to the Keras Lambda layer) but does not scan class_name: "__lambda__" (referring to the loss function type). This creates a complete bypass.1pip install keras tensorflow
2python3 exploit.pyevil_model.keras — Malicious model with lambda loss containing RCE payloadexploit.py — Loader script