{"record":{"id":"42ece1f1d1d8d2c0","repo":"keras-team/keras","slug":"requested-the-loading-of-a-vocabulary-file-outside","errorCode":null,"errorMessage":"Requested the loading of a vocabulary file outside of the model archive. This carries a potential risk of loading arbitrary and sensitive files and thus it is disallowed by default. If you trust the source of the artifact, you can override this error by passing `safe_mode=False` to the loading function, or calling `keras.config.enable_unsafe_deserialization(). Vocabulary file: '{vocabulary}'","messagePattern":"Requested the loading of a vocabulary file outside of the model archive\\. This carries a potential risk of loading arbitrary and sensitive files and thus it is disallowed by default\\. If you trust the source of the artifact, you can override this error by passing `safe_mode=False` to the loading function, or calling `keras\\.config\\.enable_unsafe_deserialization\\(\\)\\. Vocabulary file: '(.+?)'","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"keras/src/layers/preprocessing/index_lookup.py","lineNumber":446,"sourceCode":"                of inverse document frequency weights with equal\n                length to vocabulary. Must be set if `output_mode`\n                is `\"tf_idf\"`. Should not be set otherwise.\n        \"\"\"\n        if self.output_mode == \"tf_idf\":\n            if idf_weights is None:\n                raise ValueError(\n                    \"`idf_weights` must be set if output_mode is 'tf_idf'.\"\n                )\n        elif idf_weights is not None:\n            raise ValueError(\n                \"`idf_weights` should only be set if output_mode is \"\n                f\"`'tf_idf'`. Received: output_mode={self.output_mode} \"\n                f\"and idf_weights={idf_weights}\"\n            )\n\n        if isinstance(vocabulary, str):\n            if serialization_lib.in_safe_mode():\n                raise ValueError(\n                    \"Requested the loading of a vocabulary file outside of the \"\n                    \"model archive. This carries a potential risk of loading \"\n                    \"arbitrary and sensitive files and thus it is disallowed \"\n                    \"by default. If you trust the source of the artifact, you \"\n                    \"can override this error by passing `safe_mode=False` to \"\n                    \"the loading function, or calling \"\n                    \"`keras.config.enable_unsafe_deserialization(). \"\n                    f\"Vocabulary file: '{vocabulary}'\"\n                )\n\n            if not tf.io.gfile.exists(vocabulary):\n                raise ValueError(\n                    f\"Vocabulary file {vocabulary} does not exist.\"\n                )\n            if self.output_mode == \"tf_idf\":\n                raise ValueError(\n                    \"output_mode `'tf_idf'` does not support loading a \"\n                    \"vocabulary from file.\"","sourceCodeStart":428,"sourceCodeEnd":464,"githubUrl":"https://github.com/keras-team/keras/blob/7a34a03db60bf60042242d6a556fc3be119046a5/keras/src/layers/preprocessing/index_lookup.py#L428-L464","documentation":"Keras safe mode (on by default when loading) blocks deserialization that reads vocabulary files from arbitrary filesystem paths outside the model archive, since a crafted model could point at sensitive files. Loading such a model fails until you explicitly opt out.","triggerScenarios":"`keras.models.load_model('model.keras')` where the saved IndexLookup's vocabulary is stored as an external file path; internally raised from load_assets calling set_vocabulary while serialization safe mode is active.","commonSituations":"Models saved with a vocabulary file reference instead of an inlined token array; sharing models across machines where the referenced path does not even exist.","solutions":["If you trust the artifact: `keras.models.load_model(path, safe_mode=False)` or `keras.config.enable_unsafe_deserialization()`.","Better: re-save the model with the vocabulary inlined (call set_vocabulary with the token array before saving) so no external file is read on load.","Verify the model's provenance before disabling safe mode."],"exampleFix":"# before\nmodel = keras.models.load_model('model.keras')\n\n# after (trusted artifact only)\nmodel = keras.models.load_model('model.keras', safe_mode=False)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    model = keras.models.load_model(path)\nexcept ValueError as e:\n    if 'safe_mode' not in str(e):\n        raise\n    if not user_trusts_source(path):\n        raise\n    model = keras.models.load_model(path, safe_mode=False)","preventionTips":["Inline vocabularies (token arrays) before saving so loads never read external files.","Only disable safe mode for artifacts from trusted, checksum-verified sources.","Prefer re-saving untrusted-input models with current Keras before deployment."],"tags":["keras","preprocessing","index-lookup","deserialization","security"],"backgroundTag":"unsafe-deserialization-blocked","analyzedSha":"7a34a03db60bf60042242d6a556fc3be119046a5","analyzedAt":"2026-08-25T21:25:25.994Z","schemaVersion":2},"datasetVersion":"2026-08-26T02:17:13.382Z"}