Your Keras model config can contain a marshalled Python code object
Most conversations about malicious ML artifacts stop at pickle. That's understandable — torch.load calling __reduce__ is the canonical example, and it's the one everybody has read about. But pickle isn't the only file format in your models/ directory that hands a loader something executable, and the pickle story itself has more edge cases than the summary version suggests. Here are a few of the…
Keras models can include Python code objects within their configuration. When deserialising a Keras model, the embedded code object is executed, making the .keras file format akin to pickle in terms of carrying executable code. The usual method of unmarshalling to inspect the code is unsafe. Aisbom v1.3.0 identifies Lambda layers and embedded code objects as CRITICAL and never unmarshals them.
ONNX, traditionally considered safe due to the absence of embedded bytecode, can be vulnerable to arbitrary-file reads if external data references point outside the model directory. Additionally, operators from non-standard domains can lead to execution of unauthorized code. GGUF files can embed Jinja templates, which can be static analysed using Aisbom to check for security vulnerabilities.
Several assumptions made about pickle files should be re-examined, such as stopping at the first STOP opcode or trusting the container type. Aisbom identifies indirect-execution gadgets and other potential attack vectors, marking files with CRITICAL risk levels if vulnerabilities are detected. The release includes new risk levels for unhandled pickle scans and unreadable pickle members. A tool is provided to falsify evasion techniques, ensuring comprehensive coverage.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.