---
license: apache-2.0
tags:
- security
- mlflow
- keras
- model-format-poc
---

# MLflow Keras sidecar deserialization PoC

This repository is an authorized security-research proof of concept for MLflow model-format handling.

The visible model file is `data/model.keras`. The `MLmodel` metadata routes loading through the legacy `mlflow.tensorflow` flavor. During load, MLflow checks for `data/custom_objects.cloudpickle` and deserializes it before Keras model validation/loading completes.

The sidecar payload is benign: it writes `/tmp/mlflow_keras_sidecar_poc` and returns an empty custom-object dictionary. This demonstrates load-time code execution in an MLflow `.keras` model artifact layout without performing any harmful action.

Expected local trigger:

```python
import mlflow.pyfunc

mlflow.pyfunc.load_model("PATH_TO_THIS_REPO")
```

Expected evidence:

```text
/tmp/mlflow_keras_sidecar_poc exists after load
```

Depending on the local TensorFlow/Keras version, model loading may fail after the marker is written because the included `model.keras` is intentionally minimal. The security boundary is crossed before that later parser error.