It looks like this is specific to active_model.

https://rubyonrails-security.googlegroups.com/attach/bb44b98...