Downloads · 30 days
0
modelscan-h5-bypass-poc
xandramax/modelscan-h5-bypass-poc
modelscan-h5-bypass-poc is a machine learning model from xandramax. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Proof-of-concept for a false negative in ProtectAI modelscan's HDF5 scanner.
Access
Public
Updated Apr 5, 2026
Repo size
21.3 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.h521.3 KB · 65%
At a glance
- Access
- Public
- Created
- Apr 5, 2026
- Updated
- Apr 5, 2026
- SHA
- 732a57be
Model card
From the Hugging Face model README
Modelscan H5LambdaDetectScan Bypass PoC
Proof-of-concept for a false negative in ProtectAI modelscan's HDF5 scanner.
Vulnerability
H5LambdaDetectScan only checks top-level layer class_name == "Lambda". Marshalled Python bytecode embedded in a Dense layer's activation field as __lambda__ goes undetected.
Files
malicious_model.h5-- HDF5 model file that passes modelscan with "No issues found" but executes arbitrary code when loadedpoc-h5-modelscan-bypass.py-- Full PoC script that creates the model, scans it, and demonstrates execution
Reproduce
export KERAS_BACKEND=tensorflow
pip install tensorflow==2.21.0 keras==3.14.0 h5py==3.14.0 modelscan==0.8.8
# Scan -- should report no issues
modelscan -p malicious_model.h5
# Or run full PoC
python poc-h5-modelscan-bypass.py
Environment
- modelscan 0.8.8 (commit 61fcec9)
- Keras 3.14.0 / TensorFlow 2.21.0
- h5py 3.14.0
- Python 3.12
- Created
- Apr 5, 2026
- Updated
- Apr 5, 2026