keras-hub-safe-mode-huntr-poc

KerasHub safe_mode tokenizer file-read PoC

This repository contains harmless proof-of-concept .keras files for a KerasHub tokenizer safe-mode bypass.

The included model files are crafted so that keras.models.load_model() with default safe_mode=True instantiates KerasHub tokenizer layers whose config contains local file paths under /tmp. The repro script creates canary files at those paths before loading the models.

Reproduction

python3 -m venv .venv
. .venv/bin/activate
pip install keras==3.15.0 keras-hub==0.29.1 tensorflow==2.20.0 tensorflow-text==2.20.1 h5py==3.14.0
python repro.py

Expected result:

PARSEQ FILE READ CONFIRMED
WHISPER JSON FILE READ CONFIRMED

The Python audit-hook output proves the victim process opened the canary paths during keras.models.load_model() with default safe mode.

Files

• parseq_safe_mode_file_read.keras: PARSeqTokenizer vocabulary points to /tmp/keras_hub_huntr_parseq_canary.txt.
• whisper_safe_mode_file_read.keras: WhisperTokenizer special_tokens and language_tokens point to JSON canaries under /tmp.
• repro.py: creates canaries, loads both model files, and verifies re-save leakage into model artifacts.