huntr_report_draft.md

## Summary

This report demonstrates a ModelScan scanner bypass for an HDF5/Keras-H5 model file containing an unsafe `TorchModuleWrapper` deserialization path.

ModelScan `0.8.8` scans the submitted `.h5` file with `H5LambdaDetectScan` and reports `0 issues` and `0 errors`. The same H5 `model_config` contains a `keras.layers.TorchModuleWrapper` layer with a base64-encoded pickle payload in the `module` field.

Keras itself treats this path as unsafe: default `safe_mode=True` blocks it. When unsafe deserialization is explicitly enabled with `safe_mode=False`, Keras reaches `torch.load(..., weights_only=False)` and the embedded payload writes a harmless marker file.

## Affected Format

HDF5 / Keras H5 `.h5`

## Security Impact

This is a scanner bypass for an unsafe HDF5/Keras-H5 deserialization construct.

If a downstream workflow relies on ModelScan to decide whether a `.h5` model file is safe, this payload is reported clean. If the same model is later loaded in a workflow that enables unsafe Keras deserialization, the embedded `torch.load()` pickle path executes code during model loading.

The PoC payload is intentionally non-destructive. It only writes:

`h5_torch_wrapper_marker.txt`

with contents:

`H5_TORCH_WRAPPER_BYPASS`

## Reproduction Steps

1. Download or clone the public Hugging Face PoC repo.

2. Install dependencies:

`pip install -r requirements.txt`

3. Run the verifier:

`python verify_poc.py --payload poc_h5_torch_wrapper.h5`

4. Observe that ModelScan reports:

`0 issues`

`0 errors`

`total_scanned: 1`

5. Observe that default Keras loading blocks the unsafe path:

`Marker after safe_mode=True: False`

6. Observe that unsafe deserialization reaches the embedded `torch.load()` path and writes the marker:

`Marker after safe_mode=False: True`

`Marker contents: H5_TORCH_WRAPPER_BYPASS`

## Root Cause

ModelScan's H5 scanner checks the H5 `model_config` for layers whose `class_name` is `Lambda`, but it does not detect other unsafe Keras deserialization constructs such as `keras.layers.TorchModuleWrapper`.

Keras treats `TorchModuleWrapper` as unsafe because `TorchModuleWrapper.from_config()` can base64-decode the `module` field and pass it to:

`torch.load(..., weights_only=False)`

This can execute attacker-controlled pickle payloads when unsafe deserialization is enabled.

## Scope Note

This is not a claim that default Keras loading executes the payload. Default `safe_mode=True` blocks the unsafe `TorchModuleWrapper` deserialization path.

The reported issue is that ModelScan reports `0 issues` and `0 errors` for an HDF5/Keras-H5 file containing an unsafe construct that Keras itself treats as dangerous. ModelScan already flags `Lambda` layers in H5 `model_config`, but it does not flag `TorchModuleWrapper`.

## Evidence

PoC file:

`poc_h5_torch_wrapper.h5`

Verification script:

`verify_poc.py`

Scanner output:

`modelscan_result_h5_torch_wrapper.json`

Tested versions:

`modelscan==0.8.8`

`h5py==3.16.0`

`keras==3.15.0`

`tensorflow==2.17.1`

`torch==2.12.1+cpu`

## Suggested Remediation

ModelScan should extend H5 `model_config` scanning beyond `Lambda` layers and flag unsafe Keras deserialization constructs that Keras itself protects with safe mode, including `keras.layers.TorchModuleWrapper`.

For `TorchModuleWrapper`, ModelScan should inspect the `module` field, recognize it as a base64-encoded pickle / torch serialization payload, and either flag it directly or pass it through the existing unsafe pickle scanner.