CAWODOG – IP Protection PoC for Python-Based Industrial AI

CAWODOG (Cat World Dominance Group) is a playful but realistic proof-of-concept for protecting Python-based AI models deployed on offline industrial machines.

The core idea:
Take a small image classifier that detects dogs (the “enemy” of CAWODOG), wrap it in a simple app, and then progressively harden the deployment against IP theft.

The PoC is designed as a companion to an internal whitepaper on:

Hardening Python IP for Offline Industrial AI Deployments

Goals

This repository demonstrates, step by step:

• How easy it is to steal a model from a naïve Python deployment
• How to structure a Python application into UI vs. engine
• How to package and harden the engine using:
  • Nuitka onefile builds
  • ONNX export
  • Symmetric encryption of the model artifact
• How attacker workflows look at each stage

Repository Layout

.
├── 0/                     # Step 0 – Unhardened baseline
│   ├── model/             # Training + inference code
│   ├── app/               # Gradio-based web UI
│   ├── requirements.txt
│   └── (optional) build / run helpers
│
├── 1/                     # Step 1 – Packaged with Nuitka (Level 1)
│   ├── app/               # Same UI, adapted entrypoint
│   ├── model/             # Same model logic as step 0
│   ├── build.sh           # Nuitka onefile build script
│   └── requirements.txt
│
├── 2/                     # Step 2 – Encrypted ONNX model (Level 2)
│   ├── model/             # Training + ONNX export + encryption
│   ├── engine/            # Engine module (decryption + ONNX runtime + scoring)
│   ├── app/               # UI calling the engine only
│   ├── hardening/         # Encryption key + utilities (dev only)
│   ├── build.sh           # Nuitka onefile build script
│   └── requirements.txt
│
└── attacker/              # Attacker tooling (optional, for demo)
    ├── run_and_extract.sh # Finds Nuitka temp dir and lists contents
    ├── steal_model.sh     # Copies model file out of extracted payload
    └── use_stolen_model.py# Uses stolen model in a separate script

Prerequisites

• Python 3.13 (or 3.11+ if you decide to adjust the Nuitka build)
• A working virtual environment (python -m venv .venv)
• OS: tested on macOS; Linux should work with minor changes
• Recommended: git, pip, and basic command-line familiarity

Most steps require:

pip install -r requirements.txt

Step 0 – Baseline (Unhardened)

Folder: 0/ Goal: A plain Python app with a trained model and a simple web UI. No protection.

What it contains

• A small image classifier (PyTorch + torchvision) trained to distinguish:
  • dog vs not_dog
• Training script (model_training.py) that:
  • auto-splits data/dog and data/not_dog into train/validation
  • saves a model file, e.g. model/models/dog_model.pt
• Inference script (model_inference.py) that:
  • loads dog_model.pt
  • returns probability of “dog”
  • computes a simple “enemy score” as a toy heuristic
• Gradio app (app/gradio_app.py) that:
  • allows image upload in the browser
  • calls inference + enemy score
  • shows probabilities and the CAWODOG result

How to run Step 0

From the repo root:

cd 0
python -m venv .venv
source .venv/bin/activate          # on Windows: .venv\Scripts\activate
pip install -r requirements.txt

1. Prepare data:

   root@kitploit:~

   0/data/
     dog/
       <dog images>.jpg
     not_dog/
       <non-dog images>.jpg
   

2. Train the model:

   root@kitploit:~

   python -m model.model_training
   

   This will create something like:

   root@kitploit:~

   model/models/dog_model.pt
   

3. Run the Gradio app:

   root@kitploit:~

   python -m app.gradio_app
   

4. Open the printed URL (default http://127.0.0.1:7860) and test with images.

Security properties

• Model file is stored as plain PyTorch weights (.pt file).
• All model logic and scoring logic are in readable Python.
• Anyone can copy the project directory and reuse everything.

This is the “before” picture.

Step 1 – Level 1 Hardening (Nuitka Onefile)

Folder: 1/ Goal: Package the app into a single executable using Nuitka. Security effect: Makes it look like a product, but does not protect the IP.

What changes compared to Step 0

• A dedicated entry point for Nuitka (e.g. app/main.py or cawodog_app.py)
• Build script (build.sh) that:
  • installs dependencies
  • runs Nuitka with --standalone and --onefile
  • includes the model file in the bundle (dog_model.pt)
• The result is a onefile binary (e.g. cawodog_step1_nuitka).

Example build (simplified)

cd 1
source .venv/bin/activate
./build.sh

After building, you get something like:

./cawodog_step1_nuitka

Running it will start the Gradio UI as before, but now from a single executable.

Attacker simulation (optional, using attacker/)

The attacker folder shows how an attacker can:

1. Run the onefile binary (which unpacks to a temporary folder)
2. Locate the Nuitka onefile unpack directory under $TMPDIR
3. Copy dog_model.pt out of that directory
4. Use use_stolen_model.py to run predictions outside of the app

Key takeaway: Level 1 is not meaningful protection. It’s packaging, not security.

Step 2 – Level 2 Hardening (Encrypted ONNX Engine)

Folder: 2/ Goal: Introduce real IP protection at the model level. Security effect: Competitors cannot use the model by simply copying a file.

Main concepts

1. Model format conversion

   • Convert dog_model.pt → dog_model.onnx using PyTorch’s ONNX export.

2. Model encryption

   • Encrypt dog_model.onnx with AES-GCM to dog_model.enc
   • Store a symmetric key in hardening/dev_model.key (for PoC purposes)

3. Engine abstraction

   • Introduce engine/core.py that:

     • decrypts dog_model.enc at runtime
     • loads it into ONNX Runtime
     • exposes functions like predict_is_dog() and enemy_score()

4. UI as orchestrator

   • app/gradio_app.py no longer sees raw model files or internals.
   • It only calls engine functions.

Typical workflow for Step 2

cd 2
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

1. Train (or reuse) the model (same as Step 0, but inside 2/):

   root@kitploit:~

   python -m model.model_training
   

2. Export to ONNX:

   root@kitploit:~

   python -m model.export_to_onnx
   # produces model/models/dog_model.onnx
   

3. Encrypt the ONNX model:

   root@kitploit:~

   python -m hardening.encrypt_model
   # produces model/models/dog_model.enc and hardening/dev_model.key
   

4. Build with Nuitka (via build.sh):

   root@kitploit:~

   ./build.sh
   

   A key will be printed upon completion. You need to set the environment variable CAWODOG_MODEL_KEY_HEX to that key in order for the program to load the encrypted model. Any different key will result in an error.

5. Run the resulting onefile binary. The UI should behave the same as before.

Security properties

• Model file on disk (dog_model.enc) is encrypted.
• A casual attacker cannot:
  • load dog_model.enc directly in PyTorch
  • trivially inspect or modify the model
• An attacker now needs to:
  • know the encryption key
  • understand the AES-GCM decryption logic
  • extract and reconstruct the ONNX file

It is still not tied to a hardware root of trust, and a skilled reverse-engineer can eventually reconstruct the model, but the bar is significantly higher than in Step 1.

Threat Model and Limitations

This PoC focuses on:

• Protecting AI models shipped to offline customer sites
• Raising the cost of industrial espionage
• Demonstrating progressive hardening levels rather than instant “perfect security”

It does not claim to:

• Fully prevent reverse engineering by a nation-state actor
• Replace hardware-backed security modules (TPM, HSM, enclaves)
• Solve update/patch distribution or secure boot

How to Use This Repo for Demos

Typical narrative flow:

1. Step 0 – Baseline

   • Show how everything is trivial to inspect and reuse.

2. Step 1 – Packaging (Nuitka onefile)

   • Show the nice single binary.
   • Use attacker/ scripts to demonstrate how easily the model is still stolen.

3. Step 2 – Encrypted ONNX

   • Show that copying dog_model.enc is no longer sufficient.
   • Discuss how this maps to a real-world deployment for an industrial client.

You can then discuss further future levels (not implemented here yet):

• Machine-bound keys (TPM, dongle)
• Native Rust/C++ engine
• Anti-debug and integrity checks
• Secure enclaves / attestation

License

MIT License

Copyright (c) 2025 Daniel Eder

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.