AIRS AI Model Security

AI Model Security is a SaaS application that scans AI/ML models for security threats before deployment. It operates at the registry level: models are scanned before they reach production, not inline during inference.

AI/ML models can execute arbitrary code on load through deserialization attacks, Keras Lambda layers, or GGUF template injection. Traditional security tooling does not check for this. AI Model Security fills that gap by evaluating models against configurable security rules and producing a clear ALLOWED or BLOCKED verdict before the model ever reaches a runtime environment.

Threat intelligence is continuously updated by the Huntr community, a network of 16,000+ security researchers who discover novel attack vectors through bug bounty programs and a strategic partnership with Hugging Face.

The scanning agent runs locally on the user’s machine or CI runner. It downloads model artifacts from the source registry, computes a content fingerprint, and uploads scan data to the AIRS backend. The backend evaluates all enabled rules and returns a verdict.

AI Model Security evaluates models against three primary threat categories using two rule types.

Threat Categories

Rule Types

Security Groups

A security group is a collection of rules bound to a single source type. The source type binding is permanent: it cannot be changed after creation. Each tenant is provisioned with seven default security groups, one per supported source type (HuggingFace, S3, GCS, Azure Blob, Local, Artifactory, GitLab).

Rules & Rule States

Each security group contains rule instances that can be set to one of three states:

Scan Verdicts

Content-Based Fingerprinting

Models are tracked by a content fingerprint computed from the model artifacts, not by storage location. The same model scanned from S3 and HuggingFace produces the same fingerprint and maps to the same model version. A modified model under the same name produces a new fingerprint and is registered as a new version.

AI Model Security is licensed through NGFW credits, not as a standalone SKU.

The model-security-client runs on the machine that initiates scans. This can be a developer workstation, a CI/CD runner, or a dedicated scanning host.

The scanning agent requires outbound HTTPS (443) access to the following endpoints:

The deployment profile allocates NGFW credits to AI Model Security and provisions the service on the selected tenant.

1. Log in to the Customer Support Portal (CSP).
2. Navigate to Products → Software/Cloud NGFW Credits.
3. Locate the credit pool and click Create Deployment Profile.
4. Select Prisma AIRS → Model Security.
5. Enter a profile name (e.g., AI Model Security) and click Calculate Estimated Cost.
6. Review the credit allocation and click Create Deployment Profile.
7. Click Finish Setup to redirect to the Hub.
8. Select the CSP account and select or create a tenant.
9. Select the deployment profile. For Additional Services, select None.
10. Agree to the terms and click Activate.

Confirm the signed-in user has the correct role to access AI Model Security in SCM.

1. Navigate to Strata Cloud Manager → Common Services → Identity & Access.
2. Verify the current user has the role Superuser for all apps and services, or a custom role with AI Model Security enabled.

To create a custom role with minimum required permissions:

1. Navigate to Roles → Custom Roles.
2. Click Add Role.
3. Enable the AI Model Security application.
4. For API access, ensure these permissions are included: ai_ms_pypi_auth, ai_ms.scans, ai_ms.security_groups.
5. Click Save.

The model-security-client SDK and CLI authenticate using OAuth2 client credentials. A dedicated service account isolates scanning credentials from interactive user accounts.

curl -X POST "https://api.sase.paloaltonetworks.com/iam/v1/service_accounts" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "model-security-scanner",
    "description": "Service account for AI Model Security scanning"
  }'

Record the following values: they are required for SDK installation and scanning in Phase 5.

curl -X POST "https://auth.apps.paloaltonetworks.com/oauth2/access_token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "${MODEL_SECURITY_CLIENT_ID}:${MODEL_SECURITY_CLIENT_SECRET}" \
  -d "grant_type=client_credentials&scope=tsg_id:${TSG_ID}"

A successful response returns a JSON object with access_token and expires_in fields.

Each tenant is provisioned with seven default security groups, one per supported source type. Review them before creating custom groups.

curl -X GET "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/security-groups" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

Each security group contains rule instances that are evaluated during scans. Rules are organized into three categories.

Common Rules (All Source Types)

HuggingFace-Only Rules

Adjust rule states based on organizational security requirements. Each rule can be set to BLOCKING, ALLOWING, or DISABLED.

curl -X GET "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/security-groups/${GROUP_UUID}/rule-instances" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

curl -X PUT "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/security-groups/${GROUP_UUID}/rule-instances/${RULE_UUID}" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "state": "BLOCKING"
  }'

Several rules accept custom parameter values that control what is approved or blocked.

curl -X PUT "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/security-groups/${GROUP_UUID}/rule-instances/${RULE_UUID}" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "state": "BLOCKING",
    "field_values": {
      "approved_formats": ["safetensors", "safetensors_index", "json", "yaml", "onnx"]
    }
  }'

Create custom security groups when different rule configurations are needed for the same source type: for example, a strict group for production models and a permissive group for experimental models.

model-security create-security-group \
  --name "Production-S3-Strict" \
  --source-type S3

curl -X POST "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/security-groups" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production-S3-Strict",
    "source_type": "S3"
  }'

The model-security-client Python package provides both the CLI and SDK. It is hosted on a private PyPI registry authenticated through SCM.

Generate the PyPI Authentication URL

Run the following script to obtain the authenticated PyPI URL. Replace the placeholder values with the credentials from Step 3.3.

export MODEL_SECURITY_CLIENT_ID="your-client-id"
export MODEL_SECURITY_CLIENT_SECRET="your-client-secret"
export TSG_ID="your-tsg-id"

# Obtain OAuth2 token
ACCESS_TOKEN=$(curl -s -X POST \
  "https://auth.apps.paloaltonetworks.com/oauth2/access_token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "${MODEL_SECURITY_CLIENT_ID}:${MODEL_SECURITY_CLIENT_SECRET}" \
  -d "grant_type=client_credentials&scope=tsg_id:${TSG_ID}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

# Retrieve private PyPI URL
PYPI_URL=$(curl -s -X GET \
  "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/pypi/authenticate" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['pypi_url'])")

echo "PyPI URL: ${PYPI_URL}"

Install the Package

Use the authenticated URL as an extra index:

pip install "model-security-client[all]" --extra-index-url "${PYPI_URL}"

Available extras for selective dependency installation:

The CLI and SDK read credentials from environment variables. Set them in the shell session or CI/CD pipeline configuration.

export MODEL_SECURITY_CLIENT_ID="your-client-id"
export MODEL_SECURITY_CLIENT_SECRET="your-client-secret"
export TSG_ID="your-tsg-id"
export MODEL_SECURITY_API_ENDPOINT="https://api.sase.paloaltonetworks.com/aims"

HuggingFace scans are the fastest way to validate the end-to-end scanning pipeline. The AIRS backend fetches model metadata directly; no local download is required.

model-security scan \
  --security-group-uuid "${HF_GROUP_UUID}" \
  --model-uri "https://huggingface.co/microsoft/DialoGPT-medium" \
  --model-name "dialogpt-medium"

from model_security_client.api import ModelSecurityAPIClient

client = ModelSecurityAPIClient(
    base_url="https://api.sase.paloaltonetworks.com/aims"
)

result = client.scan(
    security_group_uuid="your-hf-group-uuid",
    model_uri="https://huggingface.co/microsoft/DialoGPT-medium",
    model_name="dialogpt-medium"
)

print(f"Verdict: {result.eval_outcome}")
print(f"Model Version: {result.model_version_uuid}")

Optional parameters for HuggingFace scans:

Object storage scans download the model to a local cache directory, compute the fingerprint, then upload scan data to the AIRS backend. Ensure cloud-specific credentials are configured before scanning.

model-security scan \
  --security-group-uuid "${S3_GROUP_UUID}" \
  --model-uri "s3://my-models-bucket/production/bert-base" \
  --model-name "bert-base-production"

model-security scan \
  --security-group-uuid "${GCS_GROUP_UUID}" \
  --model-uri "gs://my-models-bucket/production/bert-base" \
  --model-name "bert-base-production"

model-security scan \
  --security-group-uuid "${AZURE_GROUP_UUID}" \
  --model-uri "https://myaccount.blob.core.windows.net/models/bert-base" \
  --model-name "bert-base-production"

from model_security_client.api import ModelSecurityAPIClient

client = ModelSecurityAPIClient(
    base_url="https://api.sase.paloaltonetworks.com/aims"
)

# S3 example
result = client.scan(
    security_group_uuid="your-s3-group-uuid",
    model_uri="s3://my-models-bucket/production/bert-base",
    model_name="bert-base-production"
)

print(f"Verdict: {result.eval_outcome}")

Local scans evaluate models stored on the scanning agent’s filesystem. Use this for private models, models downloaded from private registries, or pre-release artifacts.

model-security scan \
  --security-group-uuid "${LOCAL_GROUP_UUID}" \
  --model-path "/path/to/local/model" \
  --model-name "my-custom-model"

from model_security_client.api import ModelSecurityAPIClient

client = ModelSecurityAPIClient(
    base_url="https://api.sase.paloaltonetworks.com/aims"
)

result = client.scan(
    security_group_uuid="your-local-group-uuid",
    model_path="/path/to/local/model",
    model_name="my-custom-model"
)

print(f"Verdict: {result.eval_outcome}")

Retrieve detailed scan results including per-rule evaluations and file-level findings.

model-security get-scan --uuid "${SCAN_UUID}"

model-security list-scans --limit 10

curl -X GET "https://api.sase.paloaltonetworks.com/aims/data/v1/scans/${SCAN_UUID}" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

curl -X GET "https://api.sase.paloaltonetworks.com/aims/data/v1/scans/${SCAN_UUID}/evaluations" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

curl -X GET "https://api.sase.paloaltonetworks.com/aims/data/v1/scans/${SCAN_UUID}/rule-violations" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

Per-Rule Evaluation Results

The scanning agent accepts configuration parameters to control download behavior and polling timeouts.

Scan a model that uses safe serialization formats to confirm the pipeline produces an ALLOWED verdict.

model-security scan \
  --security-group-uuid "${HF_GROUP_UUID}" \
  --model-uri "https://huggingface.co/microsoft/DialoGPT-medium" \
  --model-name "validation-safe-model"

Scan a model known to contain security threats to confirm BLOCKING rules produce a BLOCKED verdict and the CLI exits non-zero.

model-security scan \
  --security-group-uuid "${HF_GROUP_UUID}" \
  --model-uri "https://huggingface.co/<org>/<known-unsafe-model>" \
  --model-name "validation-threat-model"

echo "Exit code: $?"

Confirm both validation scans appear in the SCM dashboard with correct verdicts and detailed findings.

1. Navigate to AI Security → AI Model Security → Scans.
2. Locate the two validation scans by model name (validation-safe-model and validation-threat-model).
3. Click the safe model scan. Confirm the verdict shows a green shield and all rules passed.
4. Click the threat model scan. Confirm the verdict shows a red shield and at least one rule evaluation is FAILED.
5. On the threat model scan, navigate to the Files tab. Confirm individual file-level findings are listed with threat category details.

Confirm that scanning the same model from two different sources produces the same model version, demonstrating cross-source identity tracking.

1. Scan the same model from HuggingFace (already done in Step 7.1).
2. Download the model locally:

   git clone https://huggingface.co/microsoft/DialoGPT-medium /tmp/dialogpt-test

   Copy
3. Scan the local copy using the LOCAL security group:

   model-security scan \
     --security-group-uuid "${LOCAL_GROUP_UUID}" \
     --model-path "/tmp/dialogpt-test" \
     --model-name "validation-safe-model"

   Copy
4. Compare the model_version_uuid from both scans.

model-security list-model-versions --uuid "${MODEL_UUID}" --sort-order "desc"

A single model version appears with scan history from both the HuggingFace and Local sources.

Regularly review scan activity to ensure all model registries are covered and scans complete without errors.

model-security list-scans \
  --sort-order "desc" \
  --limit 50

Key indicators to watch:

As the organization’s model portfolio grows, refine rule configurations to reduce false positives while maintaining security posture.

• Expand approved formats — Add formats used in production (e.g., onnx, pytorch_v1_13) to the approved_formats parameter in the Stored In Approved File Format rule.
• Expand approved licenses — Add organization-approved licenses beyond the defaults to the approved_licenses parameter.
• Block specific organizations or models — Use deny_orgs and denied_org_models parameters on HuggingFace security groups to proactively block untrusted sources.
• Promote ALLOWING → BLOCKING — Once a governance rule is tuned with low false positives, promote it from ALLOWING to BLOCKING to enforce the policy.

Use content-based fingerprinting to track model evolution across registries and over time.

# List all registered models
model-security list-models --sort-order "desc" --limit 20

# View version history for a specific model
model-security list-model-versions --uuid "${MODEL_UUID}" --sort-order "desc"

# Get details for a specific model version
model-security get-model-version --uuid "${VERSION_UUID}"

Use --model-name on every scan to assign business-friendly display names. Consistent naming ensures the same model scanned from different sources maps to a single model entity.

Attach custom key-value labels to scans for categorization, filtering, and pipeline integration. Up to 50 labels per scan.

# Add labels via API
curl -X POST "https://api.sase.paloaltonetworks.com/aims/data/v1/scans/${SCAN_UUID}/labels" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "labels": [
      {"key": "environment", "value": "production"},
      {"key": "team", "value": "ml-platform"},
      {"key": "pipeline-run", "value": "build-1234"}
    ]
  }'

# List distinct label keys across all scans
curl -X GET "https://api.sase.paloaltonetworks.com/aims/data/v1/scans/label-keys" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

Gate model deployments by adding an AIRS scan step to your CI/CD pipeline. The scan exits non-zero when any model receives a BLOCKED verdict, which fails the pipeline and prevents deployment of unsafe models.

name: Model Security Scan

on:
  push:
    paths:
      - 'models/**'
  pull_request:
    paths:
      - 'models/**'

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install model-security-client
        env:
          MODEL_SECURITY_CLIENT_ID: ${{ secrets.AIRS_CLIENT_ID }}
          MODEL_SECURITY_CLIENT_SECRET: ${{ secrets.AIRS_CLIENT_SECRET }}
          TSG_ID: ${{ secrets.AIRS_TSG_ID }}
        run: |
          ACCESS_TOKEN=$(curl -s -X POST \
            "https://auth.apps.paloaltonetworks.com/oauth2/access_token" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -u "${MODEL_SECURITY_CLIENT_ID}:${MODEL_SECURITY_CLIENT_SECRET}" \
            -d "grant_type=client_credentials&scope=tsg_id:${TSG_ID}" \
            | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

          PYPI_URL=$(curl -s -X GET \
            "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/pypi/authenticate" \
            -H "Authorization: Bearer ${ACCESS_TOKEN}" \
            | python3 -c "import sys,json; print(json.load(sys.stdin)['pypi_url'])")

          pip install "model-security-client[all]" --extra-index-url "${PYPI_URL}"

      - name: Scan model
        env:
          MODEL_SECURITY_CLIENT_ID: ${{ secrets.AIRS_CLIENT_ID }}
          MODEL_SECURITY_CLIENT_SECRET: ${{ secrets.AIRS_CLIENT_SECRET }}
          TSG_ID: ${{ secrets.AIRS_TSG_ID }}
          MODEL_SECURITY_API_ENDPOINT: "https://api.sase.paloaltonetworks.com/aims"
        run: |
          RESULT=$(model-security scan \
            --security-group-uuid "${{ vars.AIRS_SECURITY_GROUP_UUID }}" \
            --model-uri "s3://${{ vars.MODEL_BUCKET }}/${{ github.ref_name }}/model" \
            --model-name "${{ github.event.repository.name }}" \
            --labels '{"key":"commit","value":"${{ github.sha }}"}' \
                     '{"key":"pipeline-run","value":"${{ github.run_id }}"}')

          echo "$RESULT"

          if echo "$RESULT" | grep -q "BLOCKED"; then
            echo "::error::Model scan returned BLOCKED verdict"
            exit 1
          fi

model-security-scan:
  stage: test
  image: python:3.11-slim
  rules:
    - changes:
        - models/**
  before_script:
    - |
      ACCESS_TOKEN=$(curl -s -X POST \
        "https://auth.apps.paloaltonetworks.com/oauth2/access_token" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -u "${MODEL_SECURITY_CLIENT_ID}:${MODEL_SECURITY_CLIENT_SECRET}" \
        -d "grant_type=client_credentials&scope=tsg_id:${TSG_ID}" \
        | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

      PYPI_URL=$(curl -s -X GET \
        "https://api.sase.paloaltonetworks.com/aims/mgmt/v1/pypi/authenticate" \
        -H "Authorization: Bearer ${ACCESS_TOKEN}" \
        | python3 -c "import sys,json; print(json.load(sys.stdin)['pypi_url'])")

      pip install "model-security-client[all]" --extra-index-url "${PYPI_URL}"
  variables:
    MODEL_SECURITY_API_ENDPOINT: "https://api.sase.paloaltonetworks.com/aims"
  script:
    - |
      RESULT=$(model-security scan \
        --security-group-uuid "${AIRS_SECURITY_GROUP_UUID}" \
        --model-uri "s3://${MODEL_BUCKET}/${CI_COMMIT_REF_NAME}/model" \
        --model-name "${CI_PROJECT_NAME}" \
        --labels '{"key":"commit","value":"'"${CI_COMMIT_SHA}"'"}' \
                 '{"key":"pipeline-run","value":"'"${CI_PIPELINE_ID}"'"}')

      echo "$RESULT"

      if echo "$RESULT" | grep -q "BLOCKED"; then
        echo "Model scan returned BLOCKED verdict"
        exit 1
      fi

AI Model Security threat intelligence is continuously updated through the Huntr community Insights DB. To contribute or dispute findings:

• Report a new threat — navigate to the Insights DB, select the model, and click Report an issue → Report your finding.
• Dispute a finding — select the flagged model and click Report an issue → Report an incorrect threat.

Models in the Insights DB are classified as Safe, Unsafe, or Suspicious. These classifications feed into the threat intelligence used by scanning rules.

High-Risk Formats (Deserialization)

Safe-by-Design Formats

Deep Learning & Other Formats

Archive Formats

Management Plane (/aims/mgmt)

Data Plane (/aims/data)

Authentication

AI Model Security is available in four regions: US, EU-Germany, India, and Singapore. The region is determined by the deployment profile you create in Strata Cloud Manager; it is encoded in your OAuth2 access token, so all API calls use the same base URL regardless of region.