AI Security Posture Management (AI-SPM)
Detect malware and hidden code in AI model files — across Pickle, PyTorch, safetensors, GGUF, and ONNX formats — before untrusted weights ever load into your environment.
AI Security Posture Management (AI-SPM)
Model weights are executable supply chain artifacts. A malicious pickle can run arbitrary code the moment a model is loaded. AI-SPM inspects model artifacts before they are trusted, catching malware and unsafe deserialization in the formats teams actually ship.
AI-SPM is the lifecycle wrapper around Safeguard's AI security — discover, assess, protect, govern, monitor. Model-artifact scanning (below) is the shipped core; it sits alongside AI-BOM discovery, which inventories the models it scans, and the AI Gateway, the runtime LLM firewall.
Model-artifact malware scanning
AI-SPM statically analyzes model files without loading them:
| Format | What AI-SPM checks for |
|---|---|
Pickle (.pkl, .bin, PyTorch state dicts) | Flags hidden code-execution instructions — imports of dangerous modules like os / subprocess / eval, and load-time steps that can run arbitrary code the moment the file is deserialized. Mapped to CWE-502 (unsafe deserialization) and CWE-94 (code injection). |
PyTorch .pt / .zip archives | Unpacks the archive and inspects every embedded component for the same hidden code-execution patterns. |
| safetensors | Confirms the file is a genuine, tensor-only artifact with no executable payload. |
| GGUF | Validates the container so malformed or tampered files are caught before use. |
| ONNX | Inspects the model graph without executing it and flags two risks: (a) custom or non-standard operators and embedded code-execution steps — CWE-94 (code injection); and (b) external-data references whose path escapes the model directory (absolute paths, .., UNC paths, or URLs) — CWE-22 (path traversal). Malformed files fail safe. |
Because these formats can execute code the moment a model loads, AI-SPM treats any hidden code-execution instruction as a high-signal finding — the whole point is to catch it before the weights are loaded. Format coverage expands over time; ONNX is the most recent format AI-SPM inspects.
Findings
Each finding identifies the artifact, the format, the specific risk that fired, and its CWE mapping. Findings flow into the unified findings model as AI-security findings, tenant/org-scoped end to end.
Configuration
AI-SPM is admin-toggleable via a feature flag, enforced server-side. Once enabled, model artifacts are scanned as they are ingested through your registries and pipelines.
Related
- AI-BOM Discovery — inventory of the models AI-SPM scans.
- AI Gateway (LLM Firewall) — runtime guardrails for prompts, responses, and tool calls.
- AI-BOM & Model Security — governing model provenance, signing, and lineage.
- Malware Detection — Eagle-based classification for packages, images, and weights.
- Unified Findings & Feature Flags — where AI-SPM findings land and how the engine is toggled.
Red Team (Defensive Adversary Emulation)
Validate your detections and attack paths with Safeguard's defensive-only adversary emulation — breach-and-attack simulation, purple-teaming, and safe attack-path analysis. No weaponized payloads, ever.
AI-BOM Discovery
Inventory every AI asset in your environment — models, ML dependencies, notebooks, prompts, vector stores, agents, MCP servers, and inference endpoints — into one tenant-scoped AI bill of materials.