Security

PAI's security model is based on defense-in-depth and operational security. This page documents what PAI protects, what it doesn't, and how to report vulnerabilities.

Threat model

PAI is designed for users who need a private, portable AI workstation — journalists, researchers, security professionals, and privacy-conscious individuals. The primary threats are:

  • Cloud AI providers collecting and analyzing your prompts
  • Network observers logging your AI usage and traffic patterns
  • Forensic analysis of the machine you used PAI on
  • Tracking across sessions via persistent identifiers

What PAI protects against

Protected
Cloud AI data harvesting

All inference is local via Ollama. Your prompts never leave your hardware.

Protected
Forensic analysis of host machine

PAI is amnesic — no disk writes, no mount of the host drive. RAM is cleared on shutdown.

Protected
Network-based tracking across sessions

MAC address randomized on every boot. New identity, new device fingerprint each time.

Protected
Local network attacks on AI services

UFW blocks all inbound connections. Ollama and PAI UI are localhost-only; unreachable from the network.

Opt-in
Network surveillance and traffic analysis

With sudo pai-privacy on, all traffic is routed through Tor. DNS resolves via Tor. Without Tor, outbound traffic is protected by the firewall but not anonymized.

Opt-in
Persistent data exposure

Without persistence: nothing survives shutdown. With persistence: data is LUKS2-encrypted on the USB drive.

What PAI does not protect against

Not mitigated
Physical hardware attacks

Keyloggers, hardware implants, or surveillance cameras on the host machine are out of scope. PAI cannot protect against an adversary with physical access to the hardware.

Not mitigated
Compromised BIOS/UEFI firmware

A tampered firmware can subvert the boot process before PAI loads. Verify the machine is trustworthy before use.

Not mitigated
Cold boot attacks

RAM retains data briefly after power-off on some hardware. Mitigated by full shutdown (not sleep/hibernate) and allowing the machine to rest before physical access.

Not mitigated
Compromised USB drive

Always verify the ISO checksum before flashing. A tampered ISO can contain malicious code that PAI cannot detect.

Partial
Global adversary (ISP + exit node correlation)

Tor protects against most network observers, but a global passive adversary who controls both the entry and exit point of a Tor circuit can perform correlation attacks. This is a known Tor limitation, not PAI-specific.

Known limitations

  • CPU-only inference — GPU drivers are stripped to keep the ISO small. This reduces the attack surface but also limits speed to 5–20 tokens/sec on most hardware.
  • No Secure Boot support — PAI's bootloader is not signed. Secure Boot must be disabled. Signed bootloader support is on the roadmap.
  • Tor is opt-in — by default, outbound traffic is not anonymized. Enable Tor with sudo pai-privacy on for network anonymity.
  • Model downloads are not anonymous — unless Tor is enabled before pulling a model, the download reveals your IP to the model host.
  • ISO signing — GPG-signed releases are planned; unsigned builds should be verified by SHA-256 checksum until then.

Vulnerability disclosure

PAI follows responsible disclosure. If you discover a security vulnerability, please report it privately before public disclosure.

How to report

  1. Use GitHub's private vulnerability reporting:Report a vulnerability ↗
  2. Or email security@pai.direct with "PAI Security" in the subject.

What to include

  • Description of the vulnerability and affected component
  • Steps to reproduce
  • Potential impact and severity assessment
  • Any suggested fixes (optional but appreciated)

Response timeline

  • Acknowledgment: within 48 hours
  • Assessment: within 7 days
  • Fix: coordinated with reporter, typically within 30–90 days
  • Disclosure: after fix is released and users have time to update

We do not offer a bug bounty program at this time, but we credit researchers in release notes.