Dynamic Code Evaluation: Unsafe TensorFlow Deserialization

Allowing unsafe deserialization in TensorFlow can enable arbitrary code execution through lambdas, posing significant security risks to applications.

When using TensorFlow, enable_unsafe_deserialization() allows an attacker to deserialize lambdas or other Python callable objects. While this feature is useful for flexibility and restoring complex models, it opens up vulnerabilities if the serialized data can be.

Example 1: The following Python code illustrates how enabling unsafe deserialization can be exploited if the serialized data is not secure:

import tensorflow as tf

tf.keras.config.enable_unsafe_deserialization()

model = tf.keras.models.load_model('evilmodel_tf.keras')
model([])

This example demonstrates the potential danger when enable_unsafe_deserialization() is used without ensuring that the source of the data is completely secure.