HiddenLayer vs Prisma AIRS 2026: Scanning Hugging Face Models

If our team pulls open-weight models from Hugging Face straight into production, we’re running someone else’s code. New reports say autonomous agents spent about two months probing Hugging Face for weak spots before a major breach. Attackers now use automation to find weak links in the AI model supply chain faster than people can review them, which makes “scan every model before it ships” a basic requirement. This guide compares HiddenLayer vs Prisma AIRS, the two enterprise scanners most security teams end up choosing between, and shows how to put a scan gate in front of our model pipeline today.

What’s actually new: HiddenLayer vs Prisma AIRS for Hugging Face model security

The attacker’s approach is new, not the file formats. Malicious pickle files, unsafe trust_remote_code repos and typosquatted model names have been known problems since 2023. According to recent reporting, automated agents mapped the Hub’s attack surface for weeks before the breach. They listed repos, tested upload paths and looked for gaps between what the platform’s built-in scanning flags and what actually runs when someone loads a model. Public details of the incident are still emerging, so treat the specific timeline with caution. The direction is clear: finding weak spots in model hubs is now cheap and automated.

The vendor landscape has also narrowed. Palo Alto Networks bought Protect AI, and Protect AI Guardian, the model scanner Hugging Face already used to label files on the Hub, now sits inside Prisma AIRS. Prisma AIRS is Palo Alto’s AI security platform, combining model scanning, AI red teaming, posture management and runtime protection. Guardian still exists, but it’s now one feature in a large platform rather than a standalone product.

HiddenLayer stayed independent. Its Model Scanner is part of the HiddenLayer AISec Platform, and its research team is known for work on graph-level backdoors (the ShadowLogic research), where malicious behavior lives in the model’s computational graph instead of a serialization exploit. So we’re choosing between a scanner inside a big network-security suite and a specialist focused on AI threats. Both check model files before deployment, but they start from different places.

Why it matters

• Hub-side scanning is not our control. Hugging Face’s scan badges help, but the platform decides what gets scanned, when, and what counts as a detection. Automated attackers test against exactly those rules. We need our own check at the point where a model enters our environment.
• Pickle is still the easiest way in. Loading a PyTorch .bin or .pt file through pickle can run arbitrary code. Scanners for malicious pickle files must cope with evasion tricks like deliberately broken pickle streams (the “nullifAI” technique) that crash the scanner but still run the payload.
• Safe formats don’t mean safe models. Safetensors stops code from running at load time. It doesn’t stop a backdoored model that behaves normally until it sees a trigger. Detecting backdoors in open-weight models requires analyzing architecture and behavior, not just file format.
• Remote code is a separate hole. Repos that need trust_remote_code=True ship Python that runs inside our process. A scanner that only checks weights won’t catch it.
• Auditors are starting to ask. AI supply chain requirements now appear in vendor questionnaires, EU AI Act readiness work and internal model risk policies. “We scan every model and keep the report” holds up. “We trust the Hub” doesn’t.
• Fine-tunes multiply the risk. Each LoRA adapter, merge and quantized copy of a base model is a new artifact from a new author. Checking the base model once doesn’t cover the dozen derivatives our team actually pulls.

How to use it today

Build the gate with free open-source tools first, then add HiddenLayer or Prisma AIRS as the enforcement layer. The pipeline then works with either vendor, and we can switch later without rebuilding it.

1. Inspect the repo before downloading anything. Check which file formats the repo contains. If it has pickle-based weights we don’t need, skip them.

   from huggingface_hub import HfApi
   
   RISKY = (".bin", ".pt", ".pth", ".pkl", ".ckpt", ".joblib", ".npy", ".h5", ".keras")
   
   api = HfApi()
   info = api.model_info("org/model-name", files_metadata=True)
   
   for f in info.siblings:
       flag = "RISKY" if f.rfilename.endswith(RISKY) else "ok"
       print(f"{flag:6} {f.rfilename} ({f.size} bytes)")
   
   print("Custom code:", any(f.rfilename.endswith(".py") for f in info.siblings))

2. Download only safe formats, pinned to a commit. Pin a specific revision so the files we scanned are the files we run. A later push to the same repo can’t change what we deploy.

   hf download org/model-name \
     --revision 3f2a9c1e0b7d... \
     --include "*.safetensors" "*.json" "tokenizer*" \
     --local-dir ./quarantine/model-name

3. Run the open-source scanners as a baseline. ModelScan (open-sourced by Protect AI) and picklescan catch common serialization attacks. Fickling helps when we need to inspect a suspicious pickle by hand.

   pip install modelscan picklescan fickling
   
   # Scan the quarantined directory, write a JSON report
   modelscan -p ./quarantine/model-name -r json -o modelscan-report.json
   
   # Scan a Hub repo directly
   picklescan --huggingface org/model-name
   
   # Decompile a suspicious pickle to readable Python
   fickling ./quarantine/model-name/pytorch_model.bin

4. Load defensively even after a clean scan. Scanners miss things. The loader is our last line of defense.

   import torch
   from transformers import AutoModelForCausalLM
   
   # Refuse pickle-based weights and remote code
   model = AutoModelForCausalLM.from_pretrained(
       "./quarantine/model-name",
       use_safetensors=True,
       trust_remote_code=False,
   )
   
   # If a raw checkpoint is unavoidable, restrict unpickling
   state = torch.load("checkpoint.pt", weights_only=True)

5. Put the gate in CI. Models reach production through a pipeline, so the scan runs there. A failed scan blocks promotion to the internal model registry.

   name: model-intake
   on:
     workflow_dispatch:
       inputs:
         repo: { required: true }
         revision: { required: true }
   
   jobs:
     scan:
       runs-on: ubuntu-latest
       steps:
         - run: pip install -U huggingface_hub modelscan
         - run: |
             hf download "${{ inputs.repo }}" \
               --revision "${{ inputs.revision }}" \
               --local-dir ./quarantine
         - name: Baseline scan (fails job on findings)
           run: modelscan -p ./quarantine -r json -o report.json
         - uses: actions/upload-artifact@v4
           with:
             name: scan-report
             path: report.json

6. Add the commercial scanner as the policy step. HiddenLayer and Prisma AIRS both offer API-based scanning that fits into the same job. Endpoints, SDK names and auth flow depend on our contract and tenant, so take them from the vendor’s documentation. The structure below is illustrative, not a real API.

   # Illustrative policy step -- replace with vendor SDK/API calls
   result = vendor_client.scan_model(
       path="./quarantine",
       model_name=repo,
       model_version=revision,
   )
   
   if result.severity in ("CRITICAL", "HIGH"):
       raise SystemExit(f"Blocked: {result.summary}")
   
   registry.promote(repo, revision, scan_id=result.id)

7. Record the result with the artifact. Store the repo, commit hash, file hashes, scanner versions and scan ID in the model registry. When a new detection rule ships, we can rescan everything already approved and answer an auditor in minutes.

How it compares

Criteria	HiddenLayer Model Scanner	Prisma AIRS (incl. Protect AI Guardian)	Open source (ModelScan / picklescan)
Core focus	Specialist AI security; model scanning is a flagship capability	One part of a broad AI security platform from a network-security vendor	Serialization attack detection only
Malicious pickle file scanning	Yes, across common ML formats	Yes; Guardian’s detection work carries over	Yes, but more exposed to evasion tricks
Backdoor / architectural analysis	Strong research background in graph-level backdoors	Covered through the platform’s scanning and red-teaming features	No
Hugging Face tie-in	Scans models we pull; check current Hub integrations	Guardian results already show up on Hub model pages	picklescan can scan Hub repos directly
Beyond model scanning	Runtime detection, red teaming, AI asset discovery	Runtime security, posture management, red teaming, agent security, tied into Palo Alto’s network and cloud products	None
Best fit	Teams that want a dedicated AI security vendor that works with any stack	Teams already standardized on Palo Alto (Strata, Prisma Cloud, Cortex)	Baseline gate, research, small teams
Pricing	Enterprise quote	Enterprise quote, usually bundled	Free

Our take: if our security operations center already runs on Palo Alto, Prisma AIRS is the easier purchase and rollout, because findings land in tools analysts already use. If we want the deepest model-specific research without depending on one vendor’s platform, HiddenLayer makes the stronger case. Either way, test both on our own model inventory before signing, including at least one sample built to evade scanners. Vendor detection claims mean little until we’ve verified them ourselves.

What’s next

Expect both vendors to move from file scanning toward behavioral checks. As the ecosystem shifts to safetensors, serialization attacks are becoming a solved problem, so attackers will turn to backdoors that survive safe formats: poisoned fine-tunes, trigger-based behaviors, and adapters that alter a trusted base model. The scanner that can reliably show a model does what its model card says will beat the one with the longest list of flagged file types.

Agent security is the other front. The reports describing agents probing Hugging Face point to a larger problem: agents that pull models, tools and MCP servers at runtime without a person approving each one. Prisma AIRS already positions itself around protecting AI agents, and HiddenLayer is building similar coverage. Watch whether scanning moves from a CI step we control to a runtime check the agent must pass before loading anything.

Finally, watch the Hub itself. After this incident, Hugging Face has every reason to tighten upload checks, require signed commits for high-download repos and expand partner scanning. Those changes help, but the main rule stands: we own the gate. Model signing standards, including Sigstore-based efforts for ML artifacts, could eventually make source verification routine.

Frequently Asked Questions

Is HiddenLayer or Prisma AIRS better for scanning Hugging Face models?

Neither wins for everyone. Prisma AIRS fits best when we already run Palo Alto products and want AI security in the same console. HiddenLayer fits best when we want a specialist AI security vendor independent of a larger platform. Test both against our actual model inventory and a few scanner-evasion samples before deciding.

What happened to Protect AI Guardian?

Palo Alto Networks bought Protect AI, and Guardian’s model scanning now runs inside Prisma AIRS. Guardian’s scan results still appear on Hugging Face model pages, but new enterprise purchases go through the Prisma AIRS platform instead of a standalone Guardian contract.

Doesn’t Hugging Face already scan models?

Yes. The Hub runs malware and pickle scanning plus partner scanners. That’s a helpful signal, but not a control we own: we don’t set the rules, we can’t block on its results in our pipeline, and automated attackers test directly against it. Treat the Hub badge as one input to our own check.

If we only use safetensors, do we still need a model scanner?

Yes. Safetensors stops code from running at load time, which removes the biggest risk from malicious pickle files. It does nothing about backdoored weights, malicious trust_remote_code Python in the repo, or poisoned tokenizer and config files. Backdoor detection for open-weight models needs architectural and behavioral analysis on top of safe formats.

Are free tools like ModelScan and picklescan enough?

For a small team, they’re a solid baseline. They focus on serialization attacks, though, and crafted evasion techniques have bypassed them before. At enterprise scale, with audit requirements, many fine-tunes and agents pulling models automatically, a commercial scanner adds wider detection, faster rule updates and audit-ready reporting.

Where should the scan happen in our pipeline?

At intake, before a model reaches any shared registry or production environment. Download to a quarantine location pinned to a specific commit, scan it there and block promotion if the scan finds anything. Store the scan ID with the artifact, and rescan approved models whenever the scanner ships new detection rules.