Keras v3.13.2

v3.13.2
Changed 2
  • Set mutable=True by default in nnx_metadata for JAX backend to ensure compatibility with Flax 0.12.3
  • Refactor H5IOStore and ShardedH5IOStore to remove unused, unverified methods
Fixed 1
  • Fix key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments
Security 3
  • Disallow TFSMLayer deserialization in safe_mode to prevent execution of attacker-controlled graphs during model invocation
  • Introduce validation for HDF5 dataset metadata in KerasFileEditor to prevent shape bomb attacks and unbounded memory allocation
  • Block external links in HDF5 files during loading to prevent weight files from pointing to external system datasets
Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

  • Disallow TFSMLayer deserialization in safe_mode (#22035)

    • Previously, TFSMLayer could load external TensorFlow SavedModels during deserialization without respecting Keras safe_mode. This could allow the execution of attacker-controlled graphs during model invocation.
    • TFSMLayer now enforces safe_mode by default. Deserialization via from_config() will raise a ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called.

  • Fix Denial of Service (DoS) in KerasFileEditor (#21880)

    • Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks.
    • Hardens the .keras file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

  • Block External Links in HDF5 files (#22057)

    • Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    • Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.
Backend-specific Improvements (JAX)
  • Set mutable=True by default in nnx_metadata (#22074)
    • Updated the JAX backend logic to ensure that variables are treated as mutable by default in nnx_metadata.
    • This makes Keras 3.13.2 compatible with Flax 0.12.3 when the Keras NNX integration is enabled.
Saving & Serialization
  • Improved H5IOStore Integrity (#22057)
    • Refactored H5IOStore and ShardedH5IOStore to remove unused, unverified methods.
    • Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.
Contributors

We would like to thank the following contributors for their security reports and code improvements: @0xManan, @HyperPS, @hertschuh, and @divyashreepathihalli.

Full Changelog: https://github.com/keras-team/keras/compare/v3.13.1...v3.13.2

View original

Upgraded? How did it go?

Discussion