class_name == "Lambda" to detect
malicious layers. However, Keras's deserialize_keras_object allows arbitrary
module imports via the _retrieve_class_or_fn function, which is not
protected by safe_mode for non-Lambda objects.layer.get("class_name", {}) == "Lambda"module.class_name pair (e.g., subprocess.Popen).keras file with a crafted config.json containing:1{
2 "module": "subprocess",
3 "class_name": "Popen",
4 "inbound_nodes": [{"args": [["command"]], "kwargs": {}}]
5}.keras files using KerasLambdaDetectScan which only
identifies Lambda layers. The malicious layer uses class_name: "Popen"
which completely bypasses detection.