Keras safe_mode is a load_model option that disallows unsafe lambda deserialization. It defaults to True and applies to the Keras v3 format. Setting it to False can trigger arbitrary code execution, so turn it off only for files from a source you control or have reviewed.
What the documentation says
The Keras API page for load_model describes safe_mode as a boolean controlling whether to disallow unsafe lambda deserialization. It says that when safe_mode is False, loading an object has the potential to trigger arbitrary code execution. It applies to the Keras v3 model format only, and the default is True.
import keras
# Default: unsafe lambda deserialization is blocked
model = keras.saving.load_model("model.keras")
# Opt out of the check, only for files you trust
model = keras.saving.load_model("model.keras", safe_mode=False)
Why lambda layers are the concern
A lambda layer wraps a Python function inside a model. To save the model, that function has to be serialized, and to load it, the function has to be rebuilt and may be run. A file from a stranger that carries a serialized function is a file that carries code.
Safe mode refuses to rebuild that kind of function. That keeps the loader from turning a model file into a program you did not choose to run.
When turning it off is reasonable
- You wrote the model, and the file came from your own pipeline.
- You can show the file was not changed since you saved it, for example by comparing a stored hash.
- A trusted colleague produced it and you know where it was stored.
- You have read the lambda function source and understand it.
When it is not
- A model downloaded from a public site with no clear owner.
- A model attached to a forum post, a chat message or an email.
- A model that came with a message asking you to turn the flag off to make it work.
That last one deserves attention. If a model only loads when you disable a safety check, the right question is why.
A safer alternative to lambda layers
If you build models, avoid lambda layers for anything you plan to share. A custom layer class, registered and shipped as a normal Python module, makes the code visible and reviewable, and it can be tracked as a dependency. Recipients can then read the code before loading anything.
Make it part of review
Search your codebase for the flag. Each place that sets it to False should have a comment that says whose file it is and why that is trusted.
grep -rn "safe_mode" .
This works as a cheap policy check in CI.
Related reading
Our posts on torch.load and weights_only and pickle risk cover the same idea in other frameworks: code can hide in a file format that looks like data.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning for the Python packages around your models, with policy gates in pull requests. Run a free scan at gold.safeguard.sh/scan.
Quick check
Does safe_mode apply to older .h5 files?
The Keras docs say the argument applies only to the Keras v3 format. Treat older formats with separate care and check the current guidance for them.
Is safe_mode a full sandbox?
No. It blocks one class of unsafe deserialization. It does not isolate the process.
Sources
Last reviewed: 19 October 2026.
