Keras model files can contain Lambda layers, which hold Python code. In the Keras v3 format, load_model has safe_mode, on by default, that disallows unsafe lambda deserialization. Setting safe_mode=False can allow arbitrary code execution during loading, so leave it on for any file you did not create yourself.
Pickle is not the only format with this problem
It is easy to think of the model file risk as a pickle problem. Hugging Face's scanner documentation makes the point that pickle is not the only exploitable format and refers to how Keras Lambda layers can be used to achieve arbitrary code execution. A Lambda layer wraps a Python function so it can sit inside a model graph. Saving the model saves that function in some form. Loading it brings the function back.
That is convenient for the author and dangerous for anyone loading a file from someone else.
What safe_mode does
The Keras documentation for load_model describes safe_mode as a boolean controlling whether to disallow unsafe lambda deserialization. When it is False, loading an object has the potential to trigger arbitrary code execution. It applies only to the Keras v3 format and defaults to True.
import keras
# Default: safe_mode=True
model = keras.saving.load_model("model.keras")
# Opt out. Only for files you created or fully trust.
# model = keras.saving.load_model("model.keras", safe_mode=False)
Two points follow from that wording. First, it covers the v3 format, so check which format your file uses. I could not confirm from the documentation I read how older formats are treated, so do not assume the same protection there. Second, it is about lambda deserialization specifically, not a general guarantee about everything a model file might contain.
A practical checklist
- Find every load_model call in your code and notebooks.
- Search for safe_mode=False. Each hit needs a written reason and an owner.
- Prefer models saved without Lambda layers, using registered custom layer classes you can review as source code instead.
- Never switch safe_mode off just because a load error told you to. The error often means the file contains something you should look at.
- When you must load a file from outside, do it in a sandbox without credentials.
When a load fails
If loading fails with a safe mode complaint, treat the message as a finding. Ask the author for a version without Lambda layers or for the layer code as a normal Python file you can review. Do not flip the flag in a shared notebook, since that setting tends to get copied.
Related: pickle alternatives for ML checkpoints.
Why this is easy to miss
Lambda layers are a convenience feature, so they appear in tutorials and example notebooks, and a model author may add one without any bad intent. The danger comes from the combination: a shared file format that can carry code, and a loader that will run it if allowed. Because nothing looks unusual in a file listing, the safest habit is a firm default. Keep safe_mode on, and require a human sign off in review whenever someone proposes turning it off.
Quick check
Does safe_mode make every Keras file safe to load?
No. The documentation describes it as disallowing unsafe lambda deserialization in the v3 format. Source and integrity checks are still needed.
Is it fine to turn safe_mode off for my own models?
For files you created and still control, the risk is lower, but keep the setting scoped to that one call and document why.
Sources
- Model saving and loading, Keras documentation
- Third-party scanner: Protect AI, Hugging Face Hub documentation
Last reviewed: 19 October 2026.
