Mostly, if you keep the defaults. Keras load_model has safe_mode set to True, which disallows unsafe lambda deserialization when loading the Keras v3 model format. Setting it to False can trigger arbitrary code execution. Keep it on for any file you did not train yourself, and treat other formats separately.
What safe_mode is
The Keras documentation describes safe_mode as a boolean that decides "whether to disallow unsafe lambda deserialization." When it is False, loading an object has the potential to trigger arbitrary code execution. The documentation says the argument applies only to the Keras v3 model format, and it defaults to True.
The reason lambdas matter is that a Lambda layer stores a Python function inside the model file. Rebuilding the model means rebuilding that function. A function can do anything Python can do, so a model with a hostile function is a program, not just a set of numbers.
What it does and does not cover
The documented scope is narrow, so be precise about it.
| Question | Answer |
|---|---|
| Does it block lambda deserialization in the v3 format? | Yes, by default |
| Does it apply to other saved formats? | The docs say it is only applicable to the v3 format |
| Does it vet custom layers you register yourself? | The page does not say it does, so review them as code |
| Does it replace trusting the source? | No |
If you load an older format, do not assume safe_mode protects you. Check the documentation for that format, and prefer converting to the v3 format from a source you trust before sharing.
When people turn it off
A model fails to load with a message about a lambda, a forum answer suggests passing safe_mode=False, and the change goes in. That is the same pattern as any warning that gets silenced. The better first move is to ask where the file came from. If your own team trained it, loading with safe_mode=False may be reasonable, and you can note why. If it came from a download, a shared drive anyone can write to, or a model hub, do not.
A short loading routine
- Confirm the source of the file and record it with the model name and version.
- Check that the file arrived over a channel you trust and compare a checksum if the publisher gives one.
- Load with the default safe_mode in a throwaway environment first.
- If loading fails because of a lambda, read the model definition as code before you decide anything.
- Only set safe_mode to False for files you produced or fully reviewed, and say so in the pull request.
For the wider picture of model files as code, see is a TensorFlow SavedModel safe to load and verify third party model files before loading.
Safeguard scans dependencies and repositories, and its policies and gates can flag changes in pull requests, including edits that loosen a safety flag. A free scan is available at gold.safeguard.sh/scan.
Quick check
Is safe_mode a sandbox?
No. It blocks one documented class of unsafe deserialization. It does not isolate the process, so keep untrusted models out of environments that hold credentials.
Can I leave safe_mode on and load any model?
You reduce one risk, but you still need to trust the source and review any custom code the model needs.
Sources
Last reviewed: 19 October 2026.
