---
library_name: keras
tags:
- security
- modelscan
- keras
- model-file-security
---

# ModelScan `.keras` nested Lambda scanner gap PoC

This repository demonstrates a scanner coverage gap in ModelScan's `.keras` Lambda detection.

Two Keras v3 files are included:

- `flat_lambda.keras`: a control model with a top-level `Lambda` layer.
- `nested_lambda.keras`: a model where the `Lambda` layer is inside a nested `Sequential` layer.

Keras treats both files as having the same Lambda deserialization risk boundary:

```text
keras.models.load_model(path, safe_mode=True)  -> blocks both files
keras.models.load_model(path, safe_mode=False) -> loads both files
```

ModelScan detects the flat control but misses the nested Lambda because its `.keras` scanner only checks top-level `config.layers` in `config.json`.

Expected ModelScan behavior with `modelscan==0.8.8` and TensorFlow installed:

```text
flat_lambda.keras   -> 1 MEDIUM issue, KerasLambdaDetectScan
nested_lambda.keras -> 0 issues
```

## Reproduce

Recommended full scanner-reproduction environment:

```bash
python3.12 -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt
python reproduce.py
```

`modelscan==0.8.8` is currently the scanner version under test. It may not install on newer Python versions such as Python 3.13. If ModelScan is not available for the current interpreter, the script still prints the Keras loader parity and config structure, then reports that native ModelScan scanning was unavailable.

For local verification with a vendored ModelScan 0.8.8 source tree, set:

```bash
MODEL_SCAN_LIB=/path/to/modelscan_lib python reproduce.py
```

The expected scanner differential is:

```text
flat_lambda.keras   -> modelscan_total_issues=1
nested_lambda.keras -> modelscan_total_issues=0
```

## Scope

This is a scanner coverage / scanner bypass issue. It is not claiming default-path arbitrary code execution in modern Keras. Modern Keras blocks Python lambda deserialization by default unless unsafe deserialization is explicitly enabled.