YARA Rules
A set of signature-based detection patterns used to scan AI pipelines and artifacts for known malicious code or tampering.
Definition
Text-based patterns or “rules” that define byte- or text-level signatures (strings, regular expressions) combined with logical conditions to detect malware, unauthorized modifications, or embedded backdoors in code repositories, model binaries, or container images. In AI governance, YARA rules are maintained in a central repository, automatically applied to every build and deployment artifact, and updated whenever new threat signatures emerge.
Real-World Example
A finance firm’s security team writes YARA rules to flag any model artifact containing disallowed imports (e.g., known-exploit libraries) or unusual strings indicative of a trojan. Their CI pipeline invokes YARA scans on every new model package, preventing deployment if any rule matches—ensuring only clean, vetted artifacts reach production.
.svg)
