Keras

AI

A high-level deep-learning API running on JAX, TensorFlow or PyTorch.

Latest v3.12.4 · by KerasWebsitekeras-team/keras

Release activity

Release activity — 10 releases across 7 days since Jan 14, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Jan 14, 2026. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 26, 2026No releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026
TuesdayNo releases on Apr 28, 2026No releases on May 5, 2026No releases on May 12, 2026No releases on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026
WednesdayNo releases on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 20261 release on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 20262 releases on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Apr 30, 20262 releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 20261 release on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on May 2, 2026No releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026

10 releases since Jan 14, 2026, busiest day 2

Changelog

v3.12.4

Keras 3.12.4

Security 4
  • Restrict unpickling when loading IMDB and Reuters datasets to only permit numpy array reconstruction, preventing arbitrary code execution via crafted .npz files
  • Verify all intermediary H5 groups when navigating H5 files to prevent potential path traversal
  • Reject decompression-bomb members on the .keras asset extraction path by adding per-member decompression-ratio checks before extracting archives to disk
  • Restrict unpickling when loading CIFAR datasets to block arbitrary code execution via pickle gadgets

Keras 3.12.4

Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.

Security Fixes
  • Restrict unpickling when loading IMDB and Reuters datasets — Replaces np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted .npz files (CWE-502). (#23047) by @LinZiyuu
  • Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. (#23168) by @hertschuh
  • Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @LinZiyuu
  • Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @SABITHSAHEB
Contributors

Thank you to all the contributors who made this release possible! 🎉

  • @LinZiyuu — Security hardening for IMDB, Reuters, and .keras asset extraction (#23047, #23101)
  • @hertschuh — H5 group verification (#23168)
  • @SABITHSAHEB — CIFAR dataset pickle restriction (#23252)

Full Changelog: https://github.com/keras-team/keras/compare/v3.12.3...v3.12.4

View originalPermalink
How v3.12.4 went
v3.15.1

Keras 3.15.1

Fixed 3
  • Improve model loading efficiency by capturing the weight store into a local variable and enhance nested container detection in legacy files with isolated failure tracking
  • Fix TraceContext errors when using JAX NNX backend with models like T5 that lack a build method by skipping trace-level checks during symbolic shape inference and handling Flax 0.12 API changes
  • Resolve NotImplementedError boolean coercion changes in Python 3.14 and fix dimension filtering in shape utilities
Security 4
  • Restrict unpickling when loading IMDB and Reuters datasets by replacing bare np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction
  • Verify all intermediary H5 groups when navigating H5 files by manually resolving nested H5 group paths to verify group types at each step
  • Reject decompression-bomb members on the .keras asset extraction path by adding per-member decompression-ratio checks before extracting archives to disk
  • Restrict unpickling when loading CIFAR datasets by replacing bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler

Release Notes

Keras 3.15.1 is a patch release containing important security hardening, bug fixes, and Python 3.14 compatibility improvements.

Security Fixes
  • Restrict unpickling when loading IMDB and Reuters datasets — Prevents insecure deserialization (CWE-502) by replacing bare np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction. (#23047) by @LinZiyuu
  • Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal issues. (#23168) by @hertschuh
  • Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @LinZiyuu
  • Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @SABITHSAHEB
Bug Fixes
  • Refactor _load_state to capture weight store while preserving Keras test passing — Improves model loading efficiency by capturing the weight store into a local variable, and enhances nested container detection in legacy files with isolated failure tracking. (#23226) by @buildwithsuhana
  • Fix TraceContext error for NNX backend — Fixes TraceContext errors when using JAX NNX backend with models like T5 that lack a build method. Skips trace-level checks during symbolic shape inference and handles Flax 0.12 API changes. Fixes #23289. (#23326) by @divyashreepathihalli
Compatibility
  • Fixes for Python 3.14 — Resolves NotImplementedError boolean coercion changes in Python 3.14 and fixes dimension filtering in shape utilities. (#23259) by @hertschuh
Contributors

Thank you to all the contributors who made this release possible! 🎉

  • @LinZiyuu — Security hardening for IMDB, Reuters, and .keras asset extraction (#23047, #23101)
  • @hertschuh — H5 group verification, Python 3.14 compatibility (#23168, #23259)
  • @buildwithsuhana — Model loading refactor (#23226)
  • @SABITHSAHEB — CIFAR dataset pickle restriction (#23252)
  • @divyashreepathihalli — NNX backend TraceContext fix (#23326)

Full Changelog: https://github.com/keras-team/keras/compare/v3.15.0...v3.15.1

View originalPermalink
How v3.15.1 went

v3.12.3

Security 14
  • Prevent HDF5 external/soft links from being exploited to read arbitrary files during model editing
  • Reject ExternalLink/SoftLink on legacy `.h5` dispatcher to extend HDF5 link rejection to the `load_weights` path
  • Block HDF5 datasets that declare excessively large shapes to prevent out-of-memory crashes during `load_model`/`load_weights`
  • Prevent virtual dataset references from being used to access external files in HDF5
  • Block tar hard links whose target resolves outside the extraction root
  • Detect and reject `.keras` archive members that declare far more data than is actually stored to prevent memory exhaustion

Keras 3.12.3 is a security patch release that hardens model saving, loading, and deserialization against a range of attack vectors.

HDF5 Hardening
  • Eject ExternalLink/SoftLink groups in KerasFileEditor (#22899)
    • Prevents HDF5 external/soft links from being exploited to read arbitrary files during model editing.
  • Reject ExternalLink/SoftLink on legacy .h5 dispatcher (#22900)
    • Extends HDF5 link rejection to the legacy load_weights path for .h5 files.
  • Reject HDF5 shape-bomb datasets (#22975)
    • Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during load_model/load_weights.
  • Reject HDF5 virtual datasets in KerasFileEditor (#22976)
    • Prevents virtual dataset references from being used to access external files.
Archive Hardening
  • Reject hard-link tar members escaping extraction directory (#22973)
    • Blocks tar hard links whose target resolves outside the extraction root.
  • Reject decompression-bomb archive members (#23010)
    • Detects and rejects .keras archive members that declare far more data than is actually stored, preventing memory exhaustion.
  • Prevent symlink traversal during extraction (#23015)
    • Resolves paths with realpath to prevent symlink-based directory traversal attacks.
  • Reject npz weight bombs (#23016)
    • Validates npz weight members against shape/decompression bombs before allocating memory.
  • Validate DiskIOStore asset paths (#23017)
    • Ensures asset paths stay within the working directory during model saving/loading.
  • Use filter="data" in TarFile.extractall (#23108)
    • Applies Python's built-in tar extraction safety filter on supported versions.
Deserialization Safety
  • Fix insecure deserialization in dataset utilities (#23026)
    • Closes an insecure deserialization path in dataset utility functions.
  • Explicitly disable pickle in np.load (#23034)
    • Prevents pickle execution when loading NumPy weight files.
  • Make Lambda/TorchModuleWrapper from_config fail closed (#23048)
    • When safe_mode is unset, Lambda and TorchModuleWrapper deserialization now fails closed instead of silently allowing arbitrary code execution.
  • Restrict reloadable APIs (#23115)
    • Expands the list of APIs that should not be part of a deserialized model.

Full Changelog: https://github.com/keras-team/keras/compare/v3.12.2...v3.12.3

View originalPermalink
How v3.12.3 went

v3.15.0

Added 9
  • Added `export_torch` function to export Keras models to native PyTorch `nn.Module` format
  • Added `sliding_window` parameter to `MultiHeadAttention` and `GroupedQueryAttention` for efficient long-context attention
  • Added `unique`, `fabs`, `fmax`, `fmin`, `dsplit`, `erfc`, `percentile`, and `nanpercentile` operations to `keras.ops.numpy`
  • Added `pinv` (pseudo-inverse) and `matrix_rank` operations to `keras.ops.linalg`
  • Added `sobel_edges` and `ssim` (structural similarity) operations to `keras.ops.image`
  • Added `MultiOptimizer` to support training sub-networks with different optimizers
Changed 5
  • Causal-only attention in `MultiHeadAttention` and `GroupedQueryAttention` now automatically dispatches to Flash Attention (cuDNN SDPA)
  • `keras.ops.transpose` now supports negative axis values
  • JAX backend now fuses Bidirectional LSTM into a single cuDNN call
  • Added fused bidirectional GRU for Torch backend
  • Added distribution information (`num_processes`, `num_model_replicas`, `data_shard_id`) to `ModelParallel`
Fixed 4
  • Fixed manual attention path to correctly apply causal masking
  • Fixed LiteRT export for Keras 3 with TensorFlow 2.20 and Python 3.13
  • Fixed float16 numerical instability in `GroupNormalization` with small epsilon
  • Fixed GPU OOM with rank-3 input in Dense layer due to `BatchMatMulV2` gradient materialization
Security 2
  • Hardened model reloading against HDF5 exploits by rejecting `ExternalLink`, `SoftLink` groups, virtual datasets, and shape-bomb datasets
  • Hardened archive loading by rejecting tar members and links escaping extraction directory and ZIP/NPZ members declaring excessive data
Highlights
  • Keras-to-Torch Export: New export_torch enables exporting Keras models to native PyTorch nn.Module format, along with LiteRT (TFLite) export support for the PyTorch backend.
  • Sliding Window Attention: Added sliding_window parameter to MultiHeadAttention and GroupedQueryAttention for efficient long-context attention.
  • Flash / Fused SDPA: Causal-only MHA/GQA now automatically dispatches to Flash Attention (cuDNN SDPA), and the manual attention path correctly applies causal masking.
  • Multi-Optimizer Training: New MultiOptimizer supports assigning different optimizers to sub-networks.
  • New Math Operations: Added unique, pinv, matrix_rank, fabs, fmax, fmin, erfc, dsplit, percentile, nanpercentile, sobel_edges, and ssim (structural similarity) to keras.ops.
  • Security Hardening: Comprehensive hardening of model reloading against HDF5 exploits, tar/zip traversal attacks, insecure deserialization.
New Features and Operations
Multi-Backend Operations
  • New NumPy Operations: Added unique, fabs, fmax, fmin, dsplit, erfc, percentile, nanpercentile in keras.ops.numpy.
  • New Linear Algebra Operations: Added pinv (pseudo-inverse) and matrix_rank in keras.ops.linalg.
  • New Image Operations: Added sobel_edges for edge detection and ssim (structural similarity) in keras.ops.image.
  • Negative Axes in Transpose: keras.ops.transpose now supports negative axis values.
Layers and Attention
  • Sliding Window Attention: MultiHeadAttention and GroupedQueryAttention layers support the sliding_window parameter for efficient long-sequence processing.
  • Flash Attention Engagement: Causal-only attention in MHA/GQA now uses Flash SDPA for significant speedups.
  • Fused Bidirectional LSTM/GRU: JAX backend now fuses Bidirectional LSTM into a single cuDNN call; fused bidirectional GRU added for Torch backend.
  • CTC Beam Search Decoder: Added CTC beam search decoding for the Torch backend.
Training and Optimizers
  • MultiOptimizer: Supports training sub-networks with different optimizers.
  • SKLearn Classifier: Added predict_proba method to SKLearnClassifier.
Export and Deployment
  • Keras-to-Torch Export: Export Keras models to native PyTorch nn.Module via model.export(..., format="torch").
  • LiteRT (TFLite) Export for PyTorch: Added LiteRT export support for models using the PyTorch backend.
  • LiteRT Compatibility Fix: Fixed LiteRT export for Keras 3 + TF 2.20 + Python 3.13.
  • ONNX Export: Support for dict/list inputs in Torch ONNX export; documented static input signature requirement for LiteRT PyTorch export.
Distribution and Parallelism
  • ModelParallel Improvements: Defined contiguous replica-group data shard ID convention; added distribution information (num_processes, num_model_replicas, data_shard_id).
  • Initializer Distribution Layout: Initializers can now handle the distribution layout directly with JAX.
  • TF Dataset Distribution: Refactored TF dataset distribution with centralized sharding routing; fixed data distribution for model training in JAX.
OpenVINO Backend Support

The OpenVINO backend received continued improvements:

  • New Operations: Implemented glu, sparsemax, gaussian_blur, logdet, cholesky, lu_factor, erfc, segment_min, segment_prod, percentile, nanmedian, nanpercentile, unique, flash_attn, greedy ctc_decode, solve_triangular, compute_homography_matrix, and image transforms (affine, perspective, elastic).
  • Opset Upgrades: Upgraded to opset16 for select operations and full upgrade.
  • Fixes: Dynamic/symbolic shape handling, mask propagation, random seed determinism, dropout during predict, Lanczos interpolation in resize, dynamic batch shape propagation, and improved efficiency using native ops.
Security
  • HDF5 Hardening: Reject ExternalLink/SoftLink groups, virtual datasets, and shape-bomb datasets in model loading.
  • Archive Hardening: Reject tar members and links escaping extraction directory, ZIP/NPZ members declaring excessive data. Validate asset paths from Orbax checkpoints.
  • Deserialization Safety: Disable pickle in np.load, fix insecure deserialization in dataset utilities, and make Lambda/TorchModuleWrapper from_config fail closed when safe_mode is unset.
  • CI/Workflow: Fix prompt injection in issue triage workflow.
Bug Fixes and Improvements
Backend Specific Improvements
  • PyTorch: Fixed convert_to_tensor for Python scalars, divide_no_nan() NaN gradients, BiLSTM dispatch, lstsq with rcond, SymInt/SymFloat handling in convert_to_tensor and slice, and median for even-length inputs.
  • JAX: Fused Bidirectional LSTM into cuDNN call.
  • TensorFlow: Fixed depthwise/separable conv with stride and dilation. Optimized tf.tensordot by removing redundant float casts.
Layers and Ops
  • Mixed Precision Fix: Fixed float16 numerical instability in GroupNormalization with small epsilon; disabled autocast for mixed precision stability.
  • Dense Layer OOM: Fixed GPU OOM with rank-3 input due to BatchMatMulV2 gradient materialization.
  • GroupQueryAttention: Fixed symbolic output shape with return_attention_scores.
  • Conv Transpose: Save output_padding in Conv1D/2D/3DTranspose get_config.
  • Attention Layer: Fixed stale return_attention_scores flag in compute_output_spec; save seed in get_config.
  • Ops Validation: Added comprehensive axis validation in softmax, normalize, swapaxes, moveaxis, sort, argsort, cumsum, cumprod, take, stack, concatenate, split, diff, transpose, and more.
  • EinsumDense: Fixed compute_output_shape to work before build.
  • Discretization: Fixed bin boundaries calculation.
Model Saving and Loading
  • Nested Sublayers: Fixed save/load for custom models/layers with sublayers in nested lists.
  • Orbax: Fixed bug from Orbax's recent rename from "pytree" to "state".
  • Sequential: Improved error handling for missing keys during deserialization.
  • Pipeline: Validated from_config layers and avoid mutating input config.
Other Improvements
  • Callbacks: Fixed EarlyStopping/ReduceLROnPlateau resetting self.best between fit calls; fixed TensorBoard callback step counter never updating.
  • Progress Bar: Removed double averaging of metrics.
  • LoRA Weights: Use float32 to avoid underflow/overflow risk.
  • Tree Utilities: Optimized tree.flatten and tree.map_structure for common cases.
  • Depthwise/Separable Conv: Removed backend-specific strides + dilation_rate restriction; validated output shapes in build; transposed channels_first to NHWC on CPU.
  • Regularizers: Allow plain callables as regularizers; fixed L1L2 regularizer.
  • Added AI Contribution Policy.
  • Added CITATION.cff for repository citation.
New Contributors

We would like to thank our new contributors for making their first contribution to the Keras project:

Full Changelog: https://github.com/keras-team/keras/compare/v3.14.0...v3.15.0

View originalPermalink
How v3.15.0 went

v3.14.1

Added 2
  • Added path validation when extracting assets from Orbax checkpoints
  • Detect loops in the graph when deserializing a functional model
Changed 2
  • Apply H5 validation to legacy .h5 file extraction
  • Improve error reporting for missing nodes in the graph during functional model deserialization
Fixed 7
  • Fixed link resolution bug when validating links extracted from TAR archives
  • Fixed path confusion bug when validating files extracted from ZIP and TAR archives including .keras files
  • Disallow external links and virtual datasets in H5 files
  • Fix data sharding logic in ModelParallel
  • Fixed regression where y_pred as a list and y_true as a dict with keys matching Functional model output names were not ordered identically and could be paired incorrectly
  • Fix regression preventing compilation with the L1L2 regularizer
  • Fix test compatibility with JAX 0.10.0
Saving & Reloading
  • Harden path and link resolution when extracting files from archives (#22839)
    • Fixed link resolution bug when validating links extracted from TAR archives.
    • Fixed path confusion bug when validating files extracted from ZIP and TAR archives (including .keras files).
    • Added path validation when extracting assets from Orbax checkpoints.
  • Harden H5 validation code and apply it to legacy .h5 files (#22801)
    • Disallow external links and virtual datasets in H5 files.
    • Also apply all the validation to the legacy .h5 file extraction.
  • Improve validation and error reporting in functional model deserialization (#22800)
    • Detect loops in the graph when deserializing a functional model.
    • Improve error reporting for missing nodes in the graph.
Other Fixes
  • Fix data sharding logic in ModelParallel (#22179)
  • Fix regression with metrics passed to compile (#22663)
    • Fixed a regression introduced in #22308 where y_pred (as a list) and y_true (as a dict with keys matching Functional model output names) were not ordered identically and could be paired incorrectly.
  • Fix regression preventing compilation with the L1L2 regularizer (#22629)
  • Fix test compatibility with JAX 0.10.0 (#22694)

Full Changelog: https://github.com/keras-team/keras/compare/v3.14.0...v3.14.1

View originalPermalink
How v3.14.1 went

v3.12.2

Added 2
  • Added path validation when extracting assets from Orbax checkpoints
  • Detect loops in the graph when deserializing a functional model
Changed 3
  • Disallow external links and virtual datasets in H5 files
  • Apply H5 validation to legacy .h5 file extraction
  • Improve error reporting for missing nodes in the graph during functional model deserialization
Fixed 4
  • Fixed base folder used when validating files extracted from ZIP and TAR archives
  • Fixed link resolution bug when validating links extracted from TAR archives
  • Fixed path confusion bug when validating files extracted from ZIP and TAR archives including .keras files
  • Fixed lazy module import handling for h5py to ensure correct and safe validation behavior when the package is lazy-loaded
Removed 1
  • Remove deprecated openvino.runtime import
Saving & Reloading
  • Harden path and link resolution when extracting files from archives (#22194 & #22839)
    • Fixed based folder used when validating files extracted from ZIP and TAR archives.
    • Fixed link resolution bug when validating links extracted from TAR archives.
    • Fixed path confusion bug when validating files extracted from ZIP and TAR archives (including .keras files).
    • Added path validation when extracting assets from Orbax checkpoints.
  • Harden H5 validation code and apply it to legacy .h5 files (#22801)
    • Disallow external links and virtual datasets in H5 files.
    • Also apply all the validation to the legacy .h5 file extraction.
  • Improve validation and error reporting in functional model deserialization (#22800)
    • Detect loops in the graph when deserializing a functional model.
    • Improve error reporting for missing nodes in the graph.
Other Fixes
  • Fix lazy module import for h5py
    • Fixed lazy module import handling for h5py to ensure correct and safe validation behavior when the package is lazy-loaded.
  • Remove deprecated openvino.runtime import (#21826)
What's Changed

Full Changelog: https://github.com/keras-team/keras/compare/v3.12.1...v3.12.2

View originalPermalink
How v3.12.2 went

v3.14.0

Added 12
  • Added full support for Orbax checkpoints, including sharding, remote paths, and step recovery
  • Added support for Activation-aware Weight Quantization (AWQ) and Asymmetric INT4 Sub-Channel Quantization
  • Added batch renormalization feature to the BatchRenormalization layer
  • Added ScheduleFreeAdamW optimizer
  • Introduced optional Gated Attention support in MultiHeadAttention and GroupedQueryAttention layers
  • Added NaN-aware NumPy operations: nanmin, nanmax, nanmean, nanmedian, nanvar, nanstd, nanprod, nanargmin, nanargmax, and nanquantile in keras.ops.numpy
Changed 3
  • PyTorch backend now supports dynamic shapes in export and includes device selection improvements
  • JAX backend improved RNG handling in FlaxLayer and JaxLayer, variable jitting improvements, and direct JAX-to-ONNX export
  • NumPy backend now supports masking
Fixed 5
  • Fixed multiple symbolic shape bugs across layers like Conv1DTranspose, IndexLookup, and TextVectorization
  • Fixed activity regularizer normalization by batch size
  • Fixed CuDNN-based LSTM and GRU implementation in PyTorch backend
  • Improved Sequential error messages for incompatible layers
  • Minimized memory usage issues in sparse_categorical_crossentropy
Highlights
  • Orbax Checkpoint Integration: Full support for Orbax checkpoints, including sharding, remote paths, and step recovery.
  • Quantization Upgrades: Added support for Activation-aware Weight Quantization (AWQ) and Asymmetric INT4 Sub-Channel Quantization.
  • Batch Renormalization in BatchNorm: Added batch renormalization feature to the BatchRenormalization layer.
  • New Optimizer: Added ScheduleFreeAdamW optimizer.
  • Gated Attention: Introduced optional Gated Attention support in MultiHeadAttention and GroupedQueryAttention layers.
New Features and Operations
Multi-Backend Operations
  • NaN-aware NumPy Operations: Added support for nanmin, nanmax, nanmean, nanmedian, nanvar, nanstd, nanprod, nanargmin, nanargmax, and nanquantile in keras.ops.numpy.
  • New Math & Linear Algebra Operators: Added nextafter, ptp, view, sinc, fmod, i0, fliplr, flipud, rad2deg, geomspace, depth_to_space, space_to_depth, and fold.
Preprocessing and Layers
  • CLAHE Layer: Added Contrast Limited Adaptive Histogram Equalization preprocessing layer.
  • Adapt Support for Iterables: Preprocessing layers now support Python iterables in the adapt() method, which allows the direct use of Grain datasets.
OpenVINO Backend Support

The OpenVINO backend received a massive update, implementing a wide array of NumPy and Neural Network operations to achieve feature parity with other backends:

  • NumPy Operations: vander, trapezoid, corrcoef, correlate, flip, diagonal, cbrt, hypot, trace, kron, argpartition, logaddexp2, ldexp, select, round, vstack, hsplit, vsplit, tile, nansum, tensordot, exp2, trunc, gcd, unravel_index, inner, cumprod, searchsorted, hanning, diagflat, norm, histogram, lcm, allclose, real, imag, isreal, kaiser, shuffle, einsum, quantile, conj, randint, in_top_k, signbit, gamma, heaviside, var, std, inv, solve, cholesky_inverse, fft, fft2, ifft2, rfft, irfft, stft, istft, scatter, binomial, unfold, QR decomposition, view, and more.
  • Neural Network Operations: Added support for separable_conv, conv_transpose, adaptive_average_pool, adaptive_max_pool, RNN, LSTM, and GRU.
  • Control Flow Operations: Implemented cond, scan, associative_scan, map, switch, fori_loop, and vectorized_map.
Bug Fixes and Improvements
Backend Specific Improvements
  • PyTorch: Dynamic shapes support in export, device selection improvements, and bug fixes to the CuDNN based LSTM and GRU implementation.
  • JAX: Improved RNG handling in FlaxLayer and JaxLayer, variable jitting improvements, and direct JAX-to-ONNX export.
  • NumPy: Enabled masking support for the NumPy backend.
Other Improvements
  • Fixed multiple symbolic shape bugs across layers like Conv1DTranspose, IndexLookup, and TextVectorization.
  • Fixed activity regularizer normalization by batch size.
  • Improved Sequential error messages for incompatible layers.
  • Minimized memory usage issues in sparse_categorical_crossentropy.
New Contributors

We would like to thank our new contributors for making their first contribution to the Keras project:

Full Changelog: https://github.com/keras-team/keras/compare/v3.13.2...v3.14.0

View originalPermalink
How v3.14.0 went

v3.12.1

Changed 1
  • Refactor H5IOStore and ShardedH5IOStore to remove unused, unverified methods
Fixed 1
  • Fix key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments
Security 3
  • Disallow TFSMLayer deserialization in safe_mode to prevent execution of attacker-controlled graphs, enforcing safe_mode by default and raising ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called
  • Fix Denial of Service in KerasFileEditor by introducing validation for HDF5 dataset metadata to prevent shape bomb attacks and unbounded memory allocation
  • Block external links in HDF5 files during loading to prevent weight files from pointing to external system datasets
Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

  • Disallow TFSMLayer deserialization in safe_mode (#22035)

    • Previously, TFSMLayer could load external TensorFlow SavedModels during deserialization without respecting Keras safe_mode. This could allow the execution of attacker-controlled graphs during model invocation.
    • TFSMLayer now enforces safe_mode by default. Deserialization via from_config() will raise a ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called.

  • Fix Denial of Service (DoS) in KerasFileEditor (#21880)

    • Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks.
    • Hardens the .keras file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

  • Block External Links in HDF5 files (#22057)

    • Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    • Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.
Saving & Serialization
  • Improved H5IOStore Integrity (#22057)
    • Refactored H5IOStore and ShardedH5IOStore to remove unused, unverified methods.
    • Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.
Acknowledgments

Special thanks to the security researchers and contributors who reported these vulnerabilities and helped implement the fixes: @0xManan, @HyperPS, and @hertschuh.

Full Changelog: https://github.com/keras-team/keras/compare/v3.12.0...v3.12.1

View originalPermalink
How v3.12.1 went

v3.13.2

Changed 2
  • Set mutable=True by default in nnx_metadata for JAX backend to ensure compatibility with Flax 0.12.3
  • Refactor H5IOStore and ShardedH5IOStore to remove unused, unverified methods
Fixed 1
  • Fix key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments
Security 3
  • Disallow TFSMLayer deserialization in safe_mode to prevent execution of attacker-controlled graphs during model invocation
  • Introduce validation for HDF5 dataset metadata in KerasFileEditor to prevent shape bomb attacks and unbounded memory allocation
  • Block external links in HDF5 files during loading to prevent weight files from pointing to external system datasets
Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

  • Disallow TFSMLayer deserialization in safe_mode (#22035)

    • Previously, TFSMLayer could load external TensorFlow SavedModels during deserialization without respecting Keras safe_mode. This could allow the execution of attacker-controlled graphs during model invocation.
    • TFSMLayer now enforces safe_mode by default. Deserialization via from_config() will raise a ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called.

  • Fix Denial of Service (DoS) in KerasFileEditor (#21880)

    • Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks.
    • Hardens the .keras file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

  • Block External Links in HDF5 files (#22057)

    • Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    • Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.
Backend-specific Improvements (JAX)
  • Set mutable=True by default in nnx_metadata (#22074)
    • Updated the JAX backend logic to ensure that variables are treated as mutable by default in nnx_metadata.
    • This makes Keras 3.13.2 compatible with Flax 0.12.3 when the Keras NNX integration is enabled.
Saving & Serialization
  • Improved H5IOStore Integrity (#22057)
    • Refactored H5IOStore and ShardedH5IOStore to remove unused, unverified methods.
    • Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.
Contributors

We would like to thank the following contributors for their security reports and code improvements: @0xManan, @HyperPS, @hertschuh, and @divyashreepathihalli.

Full Changelog: https://github.com/keras-team/keras/compare/v3.13.1...v3.13.2

View originalPermalink
How v3.13.2 went

v3.13.1

Fixed 3
  • Remove a persistent warning triggered during import keras when using NumPy 2.0 or higher
  • Fix an issue where CUDNN flash attention was broken when using JAX versions greater than 0.6.2
  • Resolve a regression in the export pipeline that incorrectly forced batch sizes to be dynamic, now correctly respecting static batch sizes when defined
Bug Fixes & Improvements
  • General
    • Removed a persistent warning triggered during import keras when using NumPy 2.0 or higher. (#21949)
  • Backends
    • JAX: Fixed an issue where CUDNN flash attention was broken when using JAX versions greater than 0.6.2. (#21970)
  • Export & Serialization
    • Resolved a regression in the export pipeline that incorrectly forced batch sizes to be dynamic. The export process now correctly respects static batch sizes when defined. (#21944)

Full Changelog: https://github.com/keras-team/keras/compare/v3.13.0...v3.13.1

View originalPermalink
How v3.13.1 went

More in AI

View all
codex

codex release notes.

codex
Ollama

Get up and running with large language models locally.

Ollama
openclaw

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

openclaw
superpowers

An agentic skills framework & software development methodology that works.

obra
ECC

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

affaan-m
hermes-agent

The agent that grows with you

NousResearch

Discussion