Could you help fix the runtime vulnerability caused by a risky pre-trained models used in this repo?

[Slverhand]

Hi, @markveilletteLL,@tonyreisll, I'd like to report that a potentially risky pretrained model is being used in this project, which may pose runtime threats. Please check the following code example:

• scripts/tornado_detection/test_tornado_keras.py

        from huggingface_hub import hf_hub_download
        trained_model = hf_hub_download(repo_id="tornet-ml/tornado_detector_baseline_v1", 
                                        filename="tornado_detector_baseline.keras")

    model = keras.saving.load_model(trained_model,compile=False)
    ···
    scores = model.evaluate(ds_test) 

Issue Description

As shown above, in the scripts/tornado_detection/test_tornado_keras.py file, the model "tornet-ml/tornado_detector_baseline_v1" and file tornado_detector_baseline.keras is downloaded and loaded by the keras.saving.load_model method. Finally used by the method model.evaluate.

This model has been flagged as risky on the HuggingFace platform. Specifically, its tornado_detector_baseline.keras file is marked as malicious and may trigger runtime threats. Once model is load, the vulnerability could be activated.

Related Risk Reports:tornet-ml/tornado_detector_baseline_v1_models

Suggested Repair Methods

1. Upgrade keras to a version above 3.9.0, and you will find that this dangerous loading has been prohibited
2. Convert the model to safer safetensors format and re-upload
3. Remove the dangerous lambda layers or custom layers in the model file and re-upload them

As one an popular machine learning projects(star:65), every potential risk could be propagated and amplified. Could you please address the above issues?

Thanks for your help~

Best regards,
Sliverhand

[markveilletteLL]

Thanks for alerting us of this. I am refactoring the baseline model so it doesn't use lambda layers or custom classes, which should hopefully address this issue. I will close this when that's done.