# Keras changelog

> A high-level deep-learning API running on JAX, TensorFlow or PyTorch.

- Vendor: Keras
- Category: AI
- Official site: https://keras.io
- Tracked by: What's New (https://whatsnew.fyi/product/keras)
- Harvested from: GitHub (keras-team/keras)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v3.12.4 — Keras 3.12.4

- Date: 2026-07-29
- Version: v3.12.4
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.12.4
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.12.4

- **security** — Restrict unpickling when loading IMDB and Reuters datasets to only permit numpy array reconstruction, preventing arbitrary code execution via crafted .npz files
- **security** — Verify all intermediary H5 groups when navigating H5 files to prevent potential path traversal
- **security** — Reject decompression-bomb members on the .keras asset extraction path by adding per-member decompression-ratio checks before extracting archives to disk
- **security** — Restrict unpickling when loading CIFAR datasets to block arbitrary code execution via pickle gadgets

#### Keras 3.12.4

Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.

##### Security Fixes

* **Restrict unpickling when loading IMDB and Reuters datasets** — Replaces `np.load(allow_pickle=True)` with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted `.npz` files (CWE-502). ([#23047](https://github.com/keras-team/keras/pull/23047)) by @LinZiyuu
* **Verify all intermediary H5 groups when navigating H5 files** — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. ([#23168](https://github.com/keras-team/keras/pull/23168)) by @hertschuh
* **Reject decompression-bomb members on the `.keras` asset extraction path** — Adds per-member decompression-ratio checks before extracting `.keras` archives to disk, preventing disk-exhaustion attacks via crafted archives. ([#23101](https://github.com/keras-team/keras/pull/23101)) by @LinZiyuu
* **Restrict unpickling when loading CIFAR datasets** — Replaces bare `cPickle.load` in CIFAR-10/100 batch loading with the numpy-only `RestrictedUnpickler`, blocking arbitrary code execution via pickle gadgets. ([#23252](https://github.com/keras-team/keras/pull/23252)) by @SABITHSAHEB

---

##### Contributors

Thank you to all the contributors who made this release possible! 🎉

* @LinZiyuu — Security hardening for IMDB, Reuters, and `.keras` asset extraction ([#23047](https://github.com/keras-team/keras/pull/23047), [#23101](https://github.com/keras-team/keras/pull/23101))
* @hertschuh — H5 group verification ([#23168](https://github.com/keras-team/keras/pull/23168))
* @SABITHSAHEB — CIFAR dataset pickle restriction ([#23252](https://github.com/keras-team/keras/pull/23252))

---

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.12.3...v3.12.4

### v3.15.1 — Keras 3.15.1

- Date: 2026-07-29
- Version: v3.15.1
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.15.1
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.15.1

- **security** — Restrict unpickling when loading IMDB and Reuters datasets by replacing bare np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction
- **security** — Verify all intermediary H5 groups when navigating H5 files by manually resolving nested H5 group paths to verify group types at each step
- **security** — Reject decompression-bomb members on the .keras asset extraction path by adding per-member decompression-ratio checks before extracting archives to disk
- **security** — Restrict unpickling when loading CIFAR datasets by replacing bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler
- **fixed** — Improve model loading efficiency by capturing the weight store into a local variable and enhance nested container detection in legacy files with isolated failure tracking
- **fixed** — Fix TraceContext errors when using JAX NNX backend with models like T5 that lack a build method by skipping trace-level checks during symbolic shape inference and handling Flax 0.12 API changes
- **fixed** — Resolve NotImplementedError boolean coercion changes in Python 3.14 and fix dimension filtering in shape utilities

#### Release Notes

Keras 3.15.1 is a patch release containing important security hardening, bug fixes, and Python 3.14 compatibility improvements.

##### Security Fixes

* **Restrict unpickling when loading IMDB and Reuters datasets** — Prevents insecure deserialization (CWE-502) by replacing bare `np.load(allow_pickle=True)` with a restricted unpickler that only permits numpy array reconstruction. ([#23047](https://github.com/keras-team/keras/pull/23047)) by @LinZiyuu
* **Verify all intermediary H5 groups when navigating H5 files** — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal issues. ([#23168](https://github.com/keras-team/keras/pull/23168)) by @hertschuh
* **Reject decompression-bomb members on the `.keras` asset extraction path** — Adds per-member decompression-ratio checks before extracting `.keras` archives to disk, preventing disk-exhaustion attacks via crafted archives. ([#23101](https://github.com/keras-team/keras/pull/23101)) by @LinZiyuu
* **Restrict unpickling when loading CIFAR datasets** — Replaces bare `cPickle.load` in CIFAR-10/100 batch loading with the numpy-only `RestrictedUnpickler`, blocking arbitrary code execution via pickle gadgets. ([#23252](https://github.com/keras-team/keras/pull/23252)) by @SABITHSAHEB

##### Bug Fixes

* **Refactor `_load_state` to capture weight store while preserving Keras test passing** — Improves model loading efficiency by capturing the weight store into a local variable, and enhances nested container detection in legacy files with isolated failure tracking. ([#23226](https://github.com/keras-team/keras/pull/23226)) by @buildwithsuhana
* **Fix TraceContext error for NNX backend** — Fixes `TraceContext` errors when using JAX NNX backend with models like T5 that lack a `build` method. Skips trace-level checks during symbolic shape inference and handles Flax 0.12 API changes. Fixes [#23289](https://github.com/keras-team/keras/issues/23289). ([#23326](https://github.com/keras-team/keras/pull/23326)) by @divyashreepathihalli

##### Compatibility

* **Fixes for Python 3.14** — Resolves `NotImplementedError` boolean coercion changes in Python 3.14 and fixes dimension filtering in shape utilities. ([#23259](https://github.com/keras-team/keras/pull/23259)) by @hertschuh

---

##### Contributors

Thank you to all the contributors who made this release possible! 🎉

* @LinZiyuu — Security hardening for IMDB, Reuters, and `.keras` asset extraction ([#23047](https://github.com/keras-team/keras/pull/23047), [#23101](https://github.com/keras-team/keras/pull/23101))
* @hertschuh — H5 group verification, Python 3.14 compatibility ([#23168](https://github.com/keras-team/keras/pull/23168), [#23259](https://github.com/keras-team/keras/pull/23259))
* @buildwithsuhana — Model loading refactor ([#23226](https://github.com/keras-team/keras/pull/23226))
* @SABITHSAHEB — CIFAR dataset pickle restriction ([#23252](https://github.com/keras-team/keras/pull/23252))
* @divyashreepathihalli — NNX backend TraceContext fix ([#23326](https://github.com/keras-team/keras/pull/23326))

---

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.15.0...v3.15.1

### v3.12.3

- Date: 2026-06-26
- Version: v3.12.3
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.12.3
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.12.3

- **security** — Prevent HDF5 external/soft links from being exploited to read arbitrary files during model editing
- **security** — Reject ExternalLink/SoftLink on legacy `.h5` dispatcher to extend HDF5 link rejection to the `load_weights` path
- **security** — Block HDF5 datasets that declare excessively large shapes to prevent out-of-memory crashes during `load_model`/`load_weights`
- **security** — Prevent virtual dataset references from being used to access external files in HDF5
- **security** — Block tar hard links whose target resolves outside the extraction root
- **security** — Detect and reject `.keras` archive members that declare far more data than is actually stored to prevent memory exhaustion
- **security** — Prevent symlink-based directory traversal attacks by resolving paths with `realpath` during extraction
- **security** — Validate npz weight members against shape and decompression bombs before allocating memory
- **security** — Ensure asset paths stay within the working directory during model saving and loading
- **security** — Apply Python's built-in tar extraction safety filter in `TarFile.extractall` on supported versions
- **security** — Close an insecure deserialization path in dataset utility functions
- **security** — Prevent pickle execution when loading NumPy weight files with `np.load`
- **security** — Make `Lambda` and `TorchModuleWrapper` `from_config` fail closed instead of silently allowing arbitrary code execution when `safe_mode` is unset
- **security** — Expand the list of APIs that should not be part of a deserialized model

Keras 3.12.3 is a security patch release that hardens model saving, loading, and deserialization against a range of attack vectors.

##### HDF5 Hardening

* **Eject ExternalLink/SoftLink groups in KerasFileEditor** (#22899)
  * Prevents HDF5 external/soft links from being exploited to read arbitrary files during model editing.
* **Reject ExternalLink/SoftLink on legacy `.h5` dispatcher** (#22900)
  * Extends HDF5 link rejection to the legacy `load_weights` path for `.h5` files.
* **Reject HDF5 shape-bomb datasets** (#22975)
  * Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during `load_model`/`load_weights`.
* **Reject HDF5 virtual datasets in KerasFileEditor** (#22976)
  * Prevents virtual dataset references from being used to access external files.

##### Archive Hardening

* **Reject hard-link tar members escaping extraction directory** (#22973)
  * Blocks tar hard links whose target resolves outside the extraction root.
* **Reject decompression-bomb archive members** (#23010)
  * Detects and rejects `.keras` archive members that declare far more data than is actually stored, preventing memory exhaustion.
* **Prevent symlink traversal during extraction** (#23015)
  * Resolves paths with `realpath` to prevent symlink-based directory traversal attacks.
* **Reject npz weight bombs** (#23016)
  * Validates npz weight members against shape/decompression bombs before allocating memory.
* **Validate DiskIOStore asset paths** (#23017)
  * Ensures asset paths stay within the working directory during model saving/loading.
* **Use `filter="data"` in `TarFile.extractall`** (#23108)
  * Applies Python's built-in tar extraction safety filter on supported versions.

##### Deserialization Safety

* **Fix insecure deserialization in dataset utilities** (#23026)
  * Closes an insecure deserialization path in dataset utility functions.
* **Explicitly disable pickle in `np.load`** (#23034)
  * Prevents pickle execution when loading NumPy weight files.
* **Make Lambda/TorchModuleWrapper `from_config` fail closed** (#23048)
  * When `safe_mode` is unset, `Lambda` and `TorchModuleWrapper` deserialization now fails closed instead of silently allowing arbitrary code execution.
* **Restrict reloadable APIs** (#23115)
  * Expands the list of APIs that should not be part of a deserialized model.

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.12.2...v3.12.3

### v3.15.0

- Date: 2026-06-24
- Version: v3.15.0
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.15.0
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.15.0

- **added** — Added `export_torch` function to export Keras models to native PyTorch `nn.Module` format
- **added** — Added `sliding_window` parameter to `MultiHeadAttention` and `GroupedQueryAttention` for efficient long-context attention
- **added** — Added `unique`, `fabs`, `fmax`, `fmin`, `dsplit`, `erfc`, `percentile`, and `nanpercentile` operations to `keras.ops.numpy`
- **added** — Added `pinv` (pseudo-inverse) and `matrix_rank` operations to `keras.ops.linalg`
- **added** — Added `sobel_edges` and `ssim` (structural similarity) operations to `keras.ops.image`
- **added** — Added `MultiOptimizer` to support training sub-networks with different optimizers
- **added** — Added `predict_proba` method to `SKLearnClassifier`
- **added** — Added LiteRT (TFLite) export support for models using the PyTorch backend
- **added** — Added CTC beam search decoding for the Torch backend
- **changed** — Causal-only attention in `MultiHeadAttention` and `GroupedQueryAttention` now automatically dispatches to Flash Attention (cuDNN SDPA)
- **changed** — `keras.ops.transpose` now supports negative axis values
- **changed** — JAX backend now fuses Bidirectional LSTM into a single cuDNN call
- **changed** — Added fused bidirectional GRU for Torch backend
- **changed** — Added distribution information (`num_processes`, `num_model_replicas`, `data_shard_id`) to `ModelParallel`
- **fixed** — Fixed manual attention path to correctly apply causal masking
- **fixed** — Fixed LiteRT export for Keras 3 with TensorFlow 2.20 and Python 3.13
- **fixed** — Fixed float16 numerical instability in `GroupNormalization` with small epsilon
- **fixed** — Fixed GPU OOM with rank-3 input in Dense layer due to `BatchMatMulV2` gradient materialization
- **security** — Hardened model reloading against HDF5 exploits by rejecting `ExternalLink`, `SoftLink` groups, virtual datasets, and shape-bomb datasets
- **security** — Hardened archive loading by rejecting tar members and links escaping extraction directory and ZIP/NPZ members declaring excessive data

##### Highlights

- **Keras-to-Torch Export**: New `export_torch` enables exporting Keras models to native PyTorch `nn.Module` format, along with LiteRT (TFLite) export support for the PyTorch backend.
- **Sliding Window Attention**: Added `sliding_window` parameter to `MultiHeadAttention` and `GroupedQueryAttention` for efficient long-context attention.
- **Flash / Fused SDPA**: Causal-only MHA/GQA now automatically dispatches to Flash Attention (cuDNN SDPA), and the manual attention path correctly applies causal masking.
- **Multi-Optimizer Training**: New `MultiOptimizer` supports assigning different optimizers to sub-networks.
- **New Math Operations**: Added `unique`, `pinv`, `matrix_rank`, `fabs`, `fmax`, `fmin`, `erfc`, `dsplit`, `percentile`, `nanpercentile`, `sobel_edges`, and `ssim` (structural similarity) to `keras.ops`.
- **Security Hardening**: Comprehensive hardening of model reloading against HDF5 exploits, tar/zip traversal attacks, insecure deserialization.

---

##### New Features and Operations

###### Multi-Backend Operations
- **New NumPy Operations**: Added `unique`, `fabs`, `fmax`, `fmin`, `dsplit`, `erfc`, `percentile`, `nanpercentile` in `keras.ops.numpy`.
- **New Linear Algebra Operations**: Added `pinv` (pseudo-inverse) and `matrix_rank` in `keras.ops.linalg`.
- **New Image Operations**: Added `sobel_edges` for edge detection and `ssim` (structural similarity) in `keras.ops.image`.
- **Negative Axes in Transpose**: `keras.ops.transpose` now supports negative axis values.

###### Layers and Attention
- **Sliding Window Attention**: `MultiHeadAttention` and `GroupedQueryAttention` layers support the `sliding_window` parameter for efficient long-sequence processing.
- **Flash Attention Engagement**: Causal-only attention in MHA/GQA now uses Flash SDPA for significant speedups.
- **Fused Bidirectional LSTM/GRU**: JAX backend now fuses Bidirectional LSTM into a single cuDNN call; fused bidirectional GRU added for Torch backend.
- **CTC Beam Search Decoder**: Added CTC beam search decoding for the Torch backend.

###### Training and Optimizers
- **MultiOptimizer**: Supports training sub-networks with different optimizers.
- **SKLearn Classifier**: Added `predict_proba` method to `SKLearnClassifier`.

---

##### Export and Deployment

- **Keras-to-Torch Export**: Export Keras models to native PyTorch `nn.Module` via `model.export(..., format="torch")`.
- **LiteRT (TFLite) Export for PyTorch**: Added LiteRT export support for models using the PyTorch backend.
- **LiteRT Compatibility Fix**: Fixed LiteRT export for Keras 3 + TF 2.20 + Python 3.13.
- **ONNX Export**: Support for dict/list inputs in Torch ONNX export; documented static input signature requirement for LiteRT PyTorch export.

---

##### Distribution and Parallelism

- **ModelParallel Improvements**: Defined contiguous replica-group data shard ID convention; added distribution information (`num_processes`, `num_model_replicas`, `data_shard_id`).
- **Initializer Distribution Layout**: Initializers can now handle the distribution layout directly with JAX.
- **TF Dataset Distribution**: Refactored TF dataset distribution with centralized sharding routing; fixed data distribution for model training in JAX.

---

##### OpenVINO Backend Support

The OpenVINO backend received continued improvements:

- **New Operations**: Implemented `glu`, `sparsemax`, `gaussian_blur`, `logdet`, `cholesky`, `lu_factor`, `erfc`, `segment_min`, `segment_prod`, `percentile`, `nanmedian`, `nanpercentile`, `unique`, `flash_attn`, `greedy ctc_decode`, `solve_triangular`, `compute_homography_matrix`, and image transforms (affine, perspective, elastic).
- **Opset Upgrades**: Upgraded to opset16 for select operations and full upgrade.
- **Fixes**: Dynamic/symbolic shape handling, mask propagation, random seed determinism, dropout during predict, Lanczos interpolation in resize, dynamic batch shape propagation, and improved ef

_[Truncated at 4000 characters — full notes: https://github.com/keras-team/keras/releases/tag/v3.15.0]_

### v3.14.1

- Date: 2026-05-07
- Version: v3.14.1
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.14.1
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.14.1

- **fixed** — Fixed link resolution bug when validating links extracted from TAR archives
- **fixed** — Fixed path confusion bug when validating files extracted from ZIP and TAR archives including .keras files
- **added** — Added path validation when extracting assets from Orbax checkpoints
- **fixed** — Disallow external links and virtual datasets in H5 files
- **changed** — Apply H5 validation to legacy .h5 file extraction
- **added** — Detect loops in the graph when deserializing a functional model
- **changed** — Improve error reporting for missing nodes in the graph during functional model deserialization
- **fixed** — Fix data sharding logic in ModelParallel
- **fixed** — Fixed regression where y_pred as a list and y_true as a dict with keys matching Functional model output names were not ordered identically and could be paired incorrectly
- **fixed** — Fix regression preventing compilation with the L1L2 regularizer
- **fixed** — Fix test compatibility with JAX 0.10.0

##### Saving & Reloading
* **Harden path and link resolution when extracting files from archives (#22839)**
  * Fixed link resolution bug when validating links extracted from TAR archives.
  * Fixed path confusion bug when validating files extracted from ZIP and TAR archives (including `.keras` files).
  * Added path validation when extracting assets from Orbax checkpoints.
* **Harden H5 validation code and apply it to legacy .h5 files (#22801)**
  * Disallow external links and virtual datasets in H5 files.
  * Also apply all the validation to the legacy .h5 file extraction.
* **Improve validation and error reporting in functional model deserialization (#22800)**
  * Detect loops in the graph when deserializing a functional model.
  * Improve error reporting for missing nodes in the graph.

##### Other Fixes
* **Fix data sharding logic in `ModelParallel` (#22179)**
* **Fix regression with metrics passed to `compile` (#22663)**
  * Fixed a regression introduced in #22308 where `y_pred` (as a list) and `y_true` (as a dict with keys matching Functional model output names) were not ordered identically and could be paired incorrectly.
* **Fix regression preventing compilation with the `L1L2` regularizer (#22629)**
* **Fix test compatibility with JAX 0.10.0 (#22694)**

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.14.0...v3.14.1

### v3.12.2

- Date: 2026-05-07
- Version: v3.12.2
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.12.2
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.12.2

- **fixed** — Fixed base folder used when validating files extracted from ZIP and TAR archives
- **fixed** — Fixed link resolution bug when validating links extracted from TAR archives
- **fixed** — Fixed path confusion bug when validating files extracted from ZIP and TAR archives including .keras files
- **added** — Added path validation when extracting assets from Orbax checkpoints
- **changed** — Disallow external links and virtual datasets in H5 files
- **changed** — Apply H5 validation to legacy .h5 file extraction
- **added** — Detect loops in the graph when deserializing a functional model
- **changed** — Improve error reporting for missing nodes in the graph during functional model deserialization
- **fixed** — Fixed lazy module import handling for h5py to ensure correct and safe validation behavior when the package is lazy-loaded
- **removed** — Remove deprecated openvino.runtime import

##### Saving & Reloading
* **Harden path and link resolution when extracting files from archives (#22194 & #22839)**
  * Fixed based folder used when validating files extracted from ZIP and TAR archives.
  * Fixed link resolution bug when validating links extracted from TAR archives.
  * Fixed path confusion bug when validating files extracted from ZIP and TAR archives (including `.keras` files).
  * Added path validation when extracting assets from Orbax checkpoints.
* **Harden H5 validation code and apply it to legacy .h5 files (#22801)**
  * Disallow external links and virtual datasets in H5 files.
  * Also apply all the validation to the legacy .h5 file extraction.
* **Improve validation and error reporting in functional model deserialization (#22800)**
  * Detect loops in the graph when deserializing a functional model.
  * Improve error reporting for missing nodes in the graph.

##### Other Fixes
* **Fix lazy module import for `h5py`**
  * Fixed lazy module import handling for `h5py` to ensure correct and safe validation behavior when the package is lazy-loaded.
* **Remove deprecated `openvino.runtime` import (#21826)**

##### What's Changed
* Patch fix 3.12.2 by @sachinprasadhs in https://github.com/keras-team/keras/pull/22850

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.12.1...v3.12.2

### v3.14.0

- Date: 2026-04-03
- Version: v3.14.0
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.14.0
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.14.0

- **added** — Added full support for Orbax checkpoints, including sharding, remote paths, and step recovery
- **added** — Added support for Activation-aware Weight Quantization (AWQ) and Asymmetric INT4 Sub-Channel Quantization
- **added** — Added batch renormalization feature to the BatchRenormalization layer
- **added** — Added ScheduleFreeAdamW optimizer
- **added** — Introduced optional Gated Attention support in MultiHeadAttention and GroupedQueryAttention layers
- **added** — Added NaN-aware NumPy operations: nanmin, nanmax, nanmean, nanmedian, nanvar, nanstd, nanprod, nanargmin, nanargmax, and nanquantile in keras.ops.numpy
- **added** — Added math and linear algebra operators: nextafter, ptp, view, sinc, fmod, i0, fliplr, flipud, rad2deg, geomspace, depth_to_space, space_to_depth, and fold
- **added** — Added Contrast Limited Adaptive Histogram Equalization (CLAHE) preprocessing layer
- **added** — Preprocessing layers now support Python iterables in the adapt() method, allowing direct use of Grain datasets
- **added** — OpenVINO backend now supports NumPy operations: vander, trapezoid, corrcoef, correlate, flip, diagonal, cbrt, hypot, trace, kron, argpartition, logaddexp2, ldexp, select, round, vstack, hsplit, vsplit, tile, nansum, tensordot, exp2, trunc, gcd, unravel_index, inner, cumprod, searchsorted, hanning, diagflat, norm, histogram, lcm, allclose, real, imag, isreal, kaiser, shuffle, einsum, quantile, conj, randint, in_top_k, signbit, gamma, heaviside, var, std, inv, solve, cholesky_inverse, fft, fft2, ifft2, rfft, irfft, stft, istft, scatter, binomial, unfold, and QR decomposition
- **added** — OpenVINO backend now supports neural network operations: separable_conv, conv_transpose, adaptive_average_pool, adaptive_max_pool, RNN, LSTM, and GRU
- **added** — OpenVINO backend now supports control flow operations: cond, scan, associative_scan, map, switch, fori_loop, and vectorized_map
- **changed** — PyTorch backend now supports dynamic shapes in export and includes device selection improvements
- **changed** — JAX backend improved RNG handling in FlaxLayer and JaxLayer, variable jitting improvements, and direct JAX-to-ONNX export
- **changed** — NumPy backend now supports masking
- **fixed** — Fixed multiple symbolic shape bugs across layers like Conv1DTranspose, IndexLookup, and TextVectorization
- **fixed** — Fixed activity regularizer normalization by batch size
- **fixed** — Fixed CuDNN-based LSTM and GRU implementation in PyTorch backend
- **fixed** — Improved Sequential error messages for incompatible layers
- **fixed** — Minimized memory usage issues in sparse_categorical_crossentropy

##### Highlights

- **Orbax Checkpoint Integration**: Full support for Orbax checkpoints, including sharding, remote paths, and step recovery.
- **Quantization Upgrades**: Added support for Activation-aware Weight Quantization (AWQ) and Asymmetric INT4 Sub-Channel Quantization.
- **Batch Renormalization in BatchNorm**: Added batch renormalization feature to the `BatchRenormalization` layer.
- **New Optimizer**: Added `ScheduleFreeAdamW` optimizer.
- **Gated Attention**: Introduced optional Gated Attention support in `MultiHeadAttention` and `GroupedQueryAttention` layers.

---

##### New Features and Operations

###### Multi-Backend Operations
- **NaN-aware NumPy Operations**: Added support for `nanmin`, `nanmax`, `nanmean`, `nanmedian`, `nanvar`, `nanstd`, `nanprod`, `nanargmin`, `nanargmax`, and `nanquantile` in `keras.ops.numpy`.
- **New Math & Linear Algebra Operators**: Added `nextafter`, `ptp`, `view`, `sinc`, `fmod`, `i0`, `fliplr`, `flipud`, `rad2deg`, `geomspace`, `depth_to_space`, `space_to_depth`, and `fold`.

###### Preprocessing and Layers
- **CLAHE Layer**: Added Contrast Limited Adaptive Histogram Equalization preprocessing layer.
- **Adapt Support for Iterables**: Preprocessing layers now support Python iterables in the `adapt()` method, which allows the direct use of Grain datasets.

---

##### OpenVINO Backend Support

The OpenVINO backend received a massive update, implementing a wide array of NumPy and Neural Network operations to achieve feature parity with other backends:

- **NumPy Operations**: `vander`, `trapezoid`, `corrcoef`, `correlate`, `flip`, `diagonal`, `cbrt`, `hypot`, `trace`, `kron`, `argpartition`, `logaddexp2`, `ldexp`, `select`, `round`, `vstack`, `hsplit`, `vsplit`, `tile`, `nansum`, `tensordot`, `exp2`, `trunc`, `gcd`, `unravel_index`, `inner`, `cumprod`, `searchsorted`, `hanning`, `diagflat`, `norm`, `histogram`, `lcm`, `allclose`, `real`, `imag`, `isreal`, `kaiser`, `shuffle`, `einsum`, `quantile`, `conj`, `randint`, `in_top_k`, `signbit`, `gamma`, `heaviside`, `var`, `std`, `inv`, `solve`, `cholesky_inverse`, `fft`, `fft2`, `ifft2`, `rfft`, `irfft`, `stft`, `istft`, `scatter`, `binomial`, `unfold`, `QR decomposition`, `view`, and more.
- **Neural Network Operations**: Added support for `separable_conv`, `conv_transpose`, `adaptive_average_pool`, `adaptive_max_pool`, `RNN`, `LSTM`, and `GRU`.
- **Control Flow Operations**: Implemented `cond`, `scan`, `associative_scan`, `map`, `switch`, `fori_loop`, and `vectorized_map`.

---

##### Bug Fixes and Improvements

###### Backend Specific Improvements
- **PyTorch**: Dynamic shapes support in export, device selection improvements, and bug fixes to the CuDNN based LSTM and GRU implementation.
- **JAX**: Improved RNG handling in `FlaxLayer` and `JaxLayer`, variable jitting improvements, and direct JAX-to-ONNX export.
- **NumPy**: Enabled masking support for the NumPy backend.

###### Other Improvements
- Fixed multiple symbolic shape bugs across layers like `Conv1DTranspose`, `IndexLookup`, and `TextVectorization`.
- Fixed activity regularizer normalization by batch size.
- Improved `Sequential` error messages for incompatible layers.
- Minimized memory usage issues in `sparse_categorical_crossentropy`.

---

##### New Contributors
We would like to thank our new contributors for making their first contribution to the Keras project:
* @vaidik-gupta made their first contribution in https://github.com/keras-team/keras/pull/21939
* @HyperPS made their first contribution in https://github.com/keras-team/keras/pull/21880
* @calad0i made their first contribution in https://github.com/keras-team/keras/pull/21959
* @KarSri7694 made their first contribution in https://github.com/keras-team/keras/pull/21963
* @MarcosAsh made their first contribution in https://github.com/keras-team/keras/pull/21961
* @orbin123 made their first contribution in https://github.com/keras-team/keras/pull/21935
* @ayulocke

_[Truncated at 4000 characters — full notes: https://github.com/keras-team/keras/releases/tag/v3.14.0]_

### v3.12.1

- Date: 2026-01-30
- Version: v3.12.1
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.12.1
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.12.1

- **security** — Disallow TFSMLayer deserialization in safe_mode to prevent execution of attacker-controlled graphs, enforcing safe_mode by default and raising ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called
- **security** — Fix Denial of Service in KerasFileEditor by introducing validation for HDF5 dataset metadata to prevent shape bomb attacks and unbounded memory allocation
- **security** — Block external links in HDF5 files during loading to prevent weight files from pointing to external system datasets
- **fixed** — Fix key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments
- **changed** — Refactor H5IOStore and ShardedH5IOStore to remove unused, unverified methods

##### Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

*   **Disallow `TFSMLayer` deserialization in `safe_mode` ([#22035](https://github.com/keras-team/keras/pull/22035))**
    *   Previously, `TFSMLayer` could load external TensorFlow SavedModels during deserialization without respecting Keras `safe_mode`. This could allow the execution of attacker-controlled graphs during model invocation.
    *   `TFSMLayer` now enforces `safe_mode` by default. Deserialization via `from_config()` will raise a `ValueError` unless `safe_mode=False` is explicitly passed or `keras.config.enable_unsafe_deserialization()` is called.

*   **Fix Denial of Service (DoS) in `KerasFileEditor` ([#21880](https://github.com/keras-team/keras/pull/21880))**
    *   Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks. 
    *   Hardens the `.keras` file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

*   **Block External Links in HDF5 files ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    *   Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

##### Saving & Serialization

*   **Improved H5IOStore Integrity ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Refactored `H5IOStore` and `ShardedH5IOStore` to remove unused, unverified methods.
    *   Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

---

###### Acknowledgments
Special thanks to the security researchers and contributors who reported these vulnerabilities and helped implement the fixes: @0xManan, @HyperPS, and @hertschuh.

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.12.0...v3.12.1

### v3.13.2

- Date: 2026-01-30
- Version: v3.13.2
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.13.2
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.13.2

- **security** — Disallow TFSMLayer deserialization in safe_mode to prevent execution of attacker-controlled graphs during model invocation
- **security** — Introduce validation for HDF5 dataset metadata in KerasFileEditor to prevent shape bomb attacks and unbounded memory allocation
- **security** — Block external links in HDF5 files during loading to prevent weight files from pointing to external system datasets
- **changed** — Set mutable=True by default in nnx_metadata for JAX backend to ensure compatibility with Flax 0.12.3
- **fixed** — Fix key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments
- **changed** — Refactor H5IOStore and ShardedH5IOStore to remove unused, unverified methods

##### Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

*   **Disallow `TFSMLayer` deserialization in `safe_mode` ([#22035](https://github.com/keras-team/keras/pull/22035))**
    *   Previously, `TFSMLayer` could load external TensorFlow SavedModels during deserialization without respecting Keras `safe_mode`. This could allow the execution of attacker-controlled graphs during model invocation.
    *   `TFSMLayer` now enforces `safe_mode` by default. Deserialization via `from_config()` will raise a `ValueError` unless `safe_mode=False` is explicitly passed or `keras.config.enable_unsafe_deserialization()` is called.

*   **Fix Denial of Service (DoS) in `KerasFileEditor` ([#21880](https://github.com/keras-team/keras/pull/21880))**
    *   Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks. 
    *   Hardens the `.keras` file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

*   **Block External Links in HDF5 files ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    *   Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

##### Backend-specific Improvements (JAX)

*   **Set `mutable=True` by default in `nnx_metadata` ([#22074](https://github.com/keras-team/keras/pull/22074))**
    *   Updated the JAX backend logic to ensure that variables are treated as mutable by default in `nnx_metadata`. 
    *   This makes Keras 3.13.2 compatible with Flax 0.12.3 when the Keras NNX integration is enabled.

##### Saving & Serialization

*   **Improved H5IOStore Integrity ([#22057](https://github.com/keras-team/keras/pull/22057))**
    *   Refactored `H5IOStore` and `ShardedH5IOStore` to remove unused, unverified methods.
    *   Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

---

###### Contributors
We would like to thank the following contributors for their security reports and code improvements:
@0xManan, @HyperPS, @hertschuh, and @divyashreepathihalli.


**Full Changelog**: https://github.com/keras-team/keras/compare/v3.13.1...v3.13.2

### v3.13.1

- Date: 2026-01-14
- Version: v3.13.1
- Original notes: https://github.com/keras-team/keras/releases/tag/v3.13.1
- Permalink: https://whatsnew.fyi/product/keras/releases/v3.13.1

- **fixed** — Remove a persistent warning triggered during import keras when using NumPy 2.0 or higher
- **fixed** — Fix an issue where CUDNN flash attention was broken when using JAX versions greater than 0.6.2
- **fixed** — Resolve a regression in the export pipeline that incorrectly forced batch sizes to be dynamic, now correctly respecting static batch sizes when defined

###### Bug Fixes & Improvements

* **General**
    * Removed a persistent warning triggered during `import keras` when using NumPy 2.0 or higher. (#21949)
* **Backends**
    * **JAX:** Fixed an issue where CUDNN flash attention was broken when using JAX versions greater than 0.6.2. (#21970)
* **Export & Serialization**
    * Resolved a regression in the export pipeline that incorrectly forced batch sizes to be dynamic. The export process now correctly respects static batch sizes when defined. (#21944)

**Full Changelog**: https://github.com/keras-team/keras/compare/v3.13.0...v3.13.1