keras-team/keras · error · ValueError

Requested the loading of a vocabulary file outside of the mo

Error message

Requested the loading of a vocabulary file outside of the model archive. This carries a potential risk of loading arbitrary and sensitive files and thus it is disallowed by default. If you trust the source of the artifact, you can override this error by passing `safe_mode=False` to the loading function, or calling `keras.config.enable_unsafe_deserialization(). Vocabulary file: '{vocabulary}'

What it means

Keras safe mode (on by default when loading) blocks deserialization that reads vocabulary files from arbitrary filesystem paths outside the model archive, since a crafted model could point at sensitive files. Loading such a model fails until you explicitly opt out.

Source

Thrown at keras/src/layers/preprocessing/index_lookup.py:446

                of inverse document frequency weights with equal
                length to vocabulary. Must be set if `output_mode`
                is `"tf_idf"`. Should not be set otherwise.
        """
        if self.output_mode == "tf_idf":
            if idf_weights is None:
                raise ValueError(
                    "`idf_weights` must be set if output_mode is 'tf_idf'."
                )
        elif idf_weights is not None:
            raise ValueError(
                "`idf_weights` should only be set if output_mode is "
                f"`'tf_idf'`. Received: output_mode={self.output_mode} "
                f"and idf_weights={idf_weights}"
            )

        if isinstance(vocabulary, str):
            if serialization_lib.in_safe_mode():
                raise ValueError(
                    "Requested the loading of a vocabulary file outside of the "
                    "model archive. This carries a potential risk of loading "
                    "arbitrary and sensitive files and thus it is disallowed "
                    "by default. If you trust the source of the artifact, you "
                    "can override this error by passing `safe_mode=False` to "
                    "the loading function, or calling "
                    "`keras.config.enable_unsafe_deserialization(). "
                    f"Vocabulary file: '{vocabulary}'"
                )

            if not tf.io.gfile.exists(vocabulary):
                raise ValueError(
                    f"Vocabulary file {vocabulary} does not exist."
                )
            if self.output_mode == "tf_idf":
                raise ValueError(
                    "output_mode `'tf_idf'` does not support loading a "
                    "vocabulary from file."

View on GitHub (pinned to 7a34a03db6)

Solutions

1. If you trust the artifact: `keras.models.load_model(path, safe_mode=False)` or `keras.config.enable_unsafe_deserialization()`.
2. Better: re-save the model with the vocabulary inlined (call set_vocabulary with the token array before saving) so no external file is read on load.
3. Verify the model's provenance before disabling safe mode.

Example fix

# before
model = keras.models.load_model('model.keras')

# after (trusted artifact only)
model = keras.models.load_model('model.keras', safe_mode=False)

try:
    model = keras.models.load_model(path)
except ValueError as e:
    if 'safe_mode' not in str(e):
        raise
    if not user_trusts_source(path):
        raise
    model = keras.models.load_model(path, safe_mode=False)

When it happens

Trigger: `keras.models.load_model('model.keras')` where the saved IndexLookup's vocabulary is stored as an external file path; internally raised from load_assets calling set_vocabulary while serialization safe mode is active.

Common situations: Models saved with a vocabulary file reference instead of an inlined token array; sharing models across machines where the referenced path does not even exist.

Related errors

• Requested the deserialization of a `TFSMLayer`, which loads
• If set, `max_tokens` must be greater than 1. Received: max_t
• If pad_to_max_tokens is True, must set `max_tokens`. Receive
• `num_oov_indices` must be greater than or equal to 0. Receiv
• `salt` can only be used when `oov_method='farmhash'`. Receiv

AI-assisted analysis of keras-team/keras@7a34a03db6 (2026-08-25). Data as JSON: /api/errors/42ece1f1d1d8d2c0. Report an issue: GitHub.