Today, we will walk through model scanning and Cisco AI defense. Model scanning is part of the AI defense posture and supply chain security feature set. Its purpose is to help ensure that the components used to create AI applications are secure.00:04In practical terms, model file scanning helps identify risks and potentially harmful files or scripts embedded in model layers. The scan takes into account model file formats, file size, detection signatures, and efficacy. The goal of this video is to explain why model scanning matters and how it works.00:19We will cover five areas today. 1st, we will look at supply chain risks in the AI ecosystem. We will then explain how model scanning works in AI defense. We will move on to review the supported artifacts, including model file formats and repository scanning. From there we will discuss threat techniques and.00:39Severity levels, including how findings are categorized. Finally, we will close with key considerations such as file size requirements, repository support, access requirements, and CLI distribution. Enterprise AI environments are increasingly dependent on 3rd party assets.00:59As AI ecosystems expand, enterprise risk exposure also rises. Organizations often rely on 3rd party models, data sets, and artifacts to build AI applications. These assets may come from external sources such as HuggingFace.01:18Or other supply chain locations. There are more than 1.9 million open source models on HuggingFace, and more than 450003rd party data sets on HuggingFace. This scale creates a broad supply chain surface. Compromised assets can be used by enterprises and risks can include model back doors, malware, data poisoning, and privacy violation.01:34A key challenge is that model artifacts often bypass standard security controls and are implicitly trusted. In many environments, they move from external sources into user devices, cloud services or workloads without the same level of inspection applied to other software components. That is why model scanning is important.01:54It provides a security checkpoint for AI assets before they are trusted and used. Model files are generally not secure by design. There are several important threat vectors like deserialization attacks. These can exploit unsafe model loaders such as pickle, joblib, or torch.load to execute our.02:10Arbitrary code during model import. Then there is malicious cares lambda layers. These can inject hidden logic that may trigger remote calls, credential theft or data exfiltration.02:30We have model poisoning. In this case, model weights maybe modified to subtly alter model behavior or bias outcomes. Then there is malicious embeddings. Our research demonstrated the ability to execute malicious code embedded inside serialized objects.02:41These examples show why scanning model files is necessary. A model artifact is not just a static file. Depending on the format and loading process, it may contain behaviors that can affect systems, data or application outputs. This is where a feature like model file scanning comes into picture.02:58Model scanning in AI defense is designed to identify vulnerabilities in model files. Scans can be initiated for either a single model file or a HuggingFace repository phone. For a single file scan, users upload a model file through the AI defense UI.03:20For repository scanning, users provide the HuggingFace repository URL. If the repository is gated or private an access token is required. Once the scan is complete, results are grouped into three categories, vulnerable, skipped, and clean files.03:37Vulnerabilities are organized by threat technique and sub technique. This helps teams understand not just that a risk exists, but what type of risk was detected. CLI and SDK scans use the AI defense API and return results in JSON. This is important for customers who want to support automation.03:53And integrate scanning into security workflows. Model scanning supports AI defense supply chain risk management. The process begins with identifying AI assets such as models, agents, applications, and MCPs.04:12AI defense can perform supply chain scanning to detect threats and vulnerabilities. These findings contribute to a supply chain report that includes a risk profile, threats, and vulnerabilities. The AI asset risk profile is then updated with a calculated risk score.04:28The findings are mapped to the AI defense supply chain taxonomy, which is aligned with industry standards. The purpose is to help customers understand and manage supply chain risk across their AI ecosystem. Instead of treating models as trusted by default.04:45Teams can scan model files and repositories to detect threats before usage. AI defense model scanning identifies vulnerabilities such as code execution, suspicious imports, and suspicious tensorflow operations.05:01It also includes clammav integration to identifying known malware signatures within model binaries. The capability supports scanning both public and private HuggingFace repositories, for gated or private repositories an access token is required.05:17When vulnerabilities are discovered, they are mapped to threat techniques and severity ratings. This mapping is important because it gives security teams a structured way to evaluate the risk. E.g., a finding related to code execution is different from a finding related to obfuscation, and severity levels help prioritize which findings need im.05:32Immediate attention.05:52Individual model file scanning allows users to scan specific model files. The supported model file types include Karas files such as.H5 or.cares there. There are pytorch files such as.pytorch or.bin.05:55There are TensorFlow files such as.PbS. There are pickle related files and archive file support, including compressed model archives such as.zip, with recursive scannings. Users can scan via GUI upload or the CLI tool. A key.06:13The requirement is that files must be under 2 gb. To scan a model file from the AI defense UI, the process is straightforward.06:321st, in AI defense, click scans. Then click new scans. In the new model file scan panel, choose single file. Upload the file by dragging it into the upload area or click the upload area to open a file browser and choose the file.06:42Finally, click start scan. Once the scan begins, AI Defense processes the model file and provides results organized by scan status and findings. This workflow is intended to make individual model file inspection accessible directly from the UI.06:59Repository scanning allows teams to quickly scan a larger number of model files through a repository scan. Repository scanning currently supports HuggingFace repositories. Both public and private HuggingFace repositories can be scanned for gated or private repositories.07:16An access token is required. To scan a repository, the user goes to scans, clicks new scan, and chooses repository in the new model file scan panels. Then the user specifies the HuggingFace repository URL. If the model is gated, the user provides the access token, and then clicks start scans.07:34Repository scanning is useful when a customer needs to assess multiple model files in a repository instead of uploading files one at a time. After a scan is complete, users can view results from the scans area in AI defenses.07:54They can find the scan result in the model scans list. The results can be filtered by name, scan date, scan type, severity of vulnerabilities detected, and scan status. To inspect the result, the user clicks the scan name. The scan results are grouped into vulnerable, skipped, and clean files.08:09Files maybe skipped due to size limitations or unsupported file types. In the vulnerable tab, users can click any discovered vulnerability record to expand it. They can also use expand all and collapse all to quickly show or hide findings.08:29Each vulnerability record shows the file name, a vulnerability identifier code such as MDL 002a description of the vulnerability and a severity characterization. The scan results are also grouped by technique such as model manipulation, and then by sub technique such as code execution.08:44AI defense allows customizing your scans using scanning profiles. The profile includes rules such as unauthorized network access and data exfiltration, which covers outbound calls to unapproved domains, DNS tunneling, and exfiltration patterns in model files.09:05It includes backdoors, poisoning, and trojanded artifacts, covering weight poisonings such as bad nets and night shades, steganography and tensors, and known trojan models through a hash database. It includes code execution and deserialization attacks, covering unsafe pickle.09:23Hightorch scripted modules, custom operators, carous lambda layers, exec, eval, sub process, and embedded scripts. It also includes vulnerable dependencies, which blocks vulnerable versions of dependencies used in model files. Another rule is detect prompt template manipulation.09:39Which detects malicious prompts in llms, including GGUFF and safe tensors metadatas. The profile also includes obfuscated payloads and hidden content, which detects obfuscated or hidden payloads inside model files.09:58The profile shows these rules as enabled. This gives customers a way to align scanning behavior with the types of model supply chain risks they want to detect. There are several risk detection and evaluation areas for model scanning.10:13These include malicious data injection, code execution vulnerability, data poisoning, and malicious behavior hidden in serialized objects. They also include model supply compromise, serialized object exploit, supply chain compromises and model artifacts.10:28Unauthorized system level commands and security vulnerabilities. Additional areas include illegal system commands, deserialization risks, unauthorized network communications, system security vulnerabilities, illicit network traffic, architectural backdoors, and arbitrary code execution during load or inference.10:44AI defense organizes detected threats using threat techniques. With model file scanning, we focus on model manipulation. This refers to malicious modifications to model behavior. Under model manipulation, there are sub techniques.11:04Code execution refers to arbitrary code execution during load or inference to this. System access refers to unauthorized system level commands. Network access refers to unauthorized network communications.11:22We also have template injection, which involves manipulating a template engine by injecting malicious code into a data field to be processed later. Unsafe embedding of model output into a server side template can allow arbitrary code execution.11:37Another category is detection of asian, which refers to attempts to hide malicious behavior. Under detection of asian, obfuscation refers to hidden malicious code in serialized objects. Each detected threat is assigned to severity level.11:52Critical means immediate risk, and the guidance is do not use the model. High means significant risk, and the model should be reviewed before use. Medium means moderate risk, and findings should be investigated. Low means minor concerns or informational findings. I have.12:08This structure helps customers prioritize which model risks require the fastest response. AI defense also supports model scanning through the CLI. The CLI supports model scanning and is distributed as a Linux binary. It uses the AI defense, API.12:26To orchestrate file and repository scanning.12:46Scans are processed in the cloud. This is useful for customers who want to integrate scanning into automated workflows while still using AI defense as the central scanning capability. There are several important considerations to keep in mind. To summarize, model scanning in Cisco AI defense.12:49Its helps teams reduce AI supply chain risk by inspecting model files and repositories for vulnerabilities and potentially harmful content. It supports individual model file scanning, HuggingFace repository scanning, UI based workflows, CLI based automation, and structured scan results.13:09Findings are grouped into vulnerable skipped, and clean files, and vulnerabilities are mapped to threat techniques and severity levels. This gives customers a clear way to understand whether a model artifact may contain risks such as code execution, system access, unauthorized network communications.13:28Obfuscation deserialization risks, poisoning or supply chain compromise. The main takeaway is that model artifacts should not be implicitly trusted. AI defense model scanning provides a structured way to evaluate those artifacts before they are used in enterprise AI applications.13:45
