A new supply chain vulnerability has been identified in the Lambda layer of third-party TensorFlow-based Keras models. This vulnerability could allow an attacker to inject arbitrary code into her AI/ML application.
Lambda layers built before Keras 2.13 version are susceptible to supply chain attacks.
Threat actors may create Trojanized popular models and distribute them to AI/ML developers.
A successful attack could allow the attacker to execute arbitrary untrusted code in the vulnerable environment with the same privileges as the running application.
Free webinar | Master WAAP/WAF ROI analysis | Reserve your spot
Lambda layer code execution flaws
The Keras framework provides a high-level interface to TensorFlow and provides several features for designing, training, validating, and packaging ML models.
The building blocks used to build neural networks are called layers. Keras provides APIs for these layers.
Keras has many layer types available, one of which is the Lambda Layer type. This type allows developers to add arbitrary code to the model as a lambda function.
This can be done using the model.save() or save_model() methods as described in the Keras documentation.
Additionally, the Keras 2 documentation describes additional mechanisms to prevent loading native version 3 Keras models. It has an option to add a lambda layer while in safe_mode.
This safe_mode is enabled by default and is responsible for allowing or disallowing unsafe lambda deserialization, which can potentially trigger execution of arbitrary code.
However, starting with Keras version 2.13, the program will raise an exception if you try to load a model that contains a Lambda layer saved in version 3 format.
This particular mechanism does not exist in versions prior to 2.13, so code that is untrusted in earlier versions will be deserialized.
According to the TensorFlow documentation, a statement is provided as a warning to developers, which is probably not fully understood by new AI/ML community members.
“Models are actually programs that TensorFlow runs, so using an untrusted model or graph is the same as running untrusted code,” the statement said.
However, the “Arguments” section of the Kensar framework documentation for the load_model function mentions an option called safe_mode. This is a Boolean value that indicates whether unsafe lambda deserialization is prohibited.
If safe_mode=False, loading an object can trigger execution of arbitrary code. This argument applies only to Keras v3 model format. Default is True. ”
This code injection vulnerability when packaging data with code is not new. In the past, there have been several instances where code can be serialized around this data, such as his Pickle mechanism in the standard Python library.
To prevent this type of supply chain attack, we recommend that developers upgrade to the latest Keras version 2.13 or later to ensure that no valuable assets are within the scope of the running application.
This reduces the possibility of data leakage for pre-2.13 applications in the sandbox.
Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.
