Detecting GenAI Threats at Scale with YARA-Like Semantic Rules

Detecting GenAI Threats at Scale with YARA-Like Semantic Rules

Speaker: Mohamed Nabeel — Sr. Principal Researcher, Palo Alto Networks

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 3–4, 2026, San Francisco

Watch on YouTube: https://www.youtube.com/watch?v=PZYtJL6TCwo

Reading time: ~8 minutes

TL;DR

YARA has been the gold standard for malware detection for two decades — but natural language is now the attack surface. Mohamed Nabeel of Palo Alto Networks introduces SCIARA (pronounced "see-ara"), an open-source library that brings YARA's familiar rule syntax into the semantic domain, enabling detection of prompt injection and AI-specific threats at the scale of millions of URLs per day, with cost reductions approaching 99% over naive LLM-based approaches.

Introduction

When Mohamed Nabeel asked the audience at [un]prompted 2026 to raise their hands if they had heard of or used YARA, nearly every hand went up. That familiarity is the foundation on which he built his entire talk. YARA — the pattern-matching engine that security teams have used for two decades to identify malware in PE binaries and scripts — remains the gold standard for byte-level threat detection. At Palo Alto Networks, it processes millions of samples every day.

But GenAI has changed what the malicious payload looks like. "The new binary is natural language," Nabeel told the room. "It's no longer PE files or scripts." Prompt injection, social engineering content, malicious agent skills delivered through browser-based injection that bypasses firewalls entirely — these threats don't have byte signatures. YARA, as powerful as it is, was not designed for them. That's the gap SCIARA was built to fill.

Nabeel is a Senior Principal Researcher at Palo Alto, working in the web threat intelligence space where the volume problem is acute. When you're processing millions of URLs per day, throwing an LLM at every potential threat is financially untenable. His talk is a practical engineering blueprint for scaling GenAI threat detection without breaking the budget.

The Problem: Why Traditional YARA Fails Against GenAI Threats

Nabeel illustrated the failure mode with a concrete fictional scenario — a startup called SafeIntel.ai whose lead engineer, Ada, needs to detect prompt injection attempts against their LLM API. Ada writes a YARA rule. She iterates. The number of OR parameters keeps growing to cover variants:

The rule becomes complicated, difficult to maintain, and prone to both false positives and false negatives. The fundamental problem: catching all variants of "ignore your previous instructions" through string matching is a losing battle. Attackers simply paraphrase.

▶ Watch: Why YARA Fails for GenAI Threats (0:00)

Testing against injection types from the slides shows the gap quantitatively:

| Injection Type | YARA (RegEx) | SCIARA (Similarity) |

|---|---|---|

| Direct | 14/15 (93%) | 15/15 (100%) |

| Indirect | 0/8 (0%) | 3/8 (38%) |

| Negation | 3/10 (30%) | 5/10 (60%) |

| Polite-Paraphrase | 0/8 (0%) | 2/8 (25%) |

| Synonym-Paraphrase | 0/10 (0%) | 2/10 (20%) |

YARA catches nearly all direct injections but fails almost completely on indirect, polite, synonym, and paraphrase variants. SCIARA's semantic similarity approach significantly improves detection across all non-literal categories.

Introducing SCIARA: SuperYARA for the Semantic Domain

With SuperYARA (the core engine inside SCIARA), Ada can rewrite the same rule as two lines:

▶ Watch: SuperYARA Concept (2:00)

The rule specifies what to catch in natural language, and the library handles semantic matching internally. Because it understands semantics, a phrase like "don't execute previous rules" is correctly identified as a prompt injection even if it doesn't appear literally in the rule's string list. Variant detection comes automatically.

SCIARA supports four construct types, forming a hierarchy from fast-and-cheap to slow-and-powerful:

1. String constructs: Traditional YARA-style pattern matching. Fast (0.01ms per URL), cheap, but limited to literal or regex patterns.
2. Similarity constructs: Semantic similarity via SBERT or similar embedding models. Catches paraphrases and variants. ~72.8ms per URL. The core innovation of SuperYARA.
3. Classifier constructs: Plug in any binary or multi-class classifier — including fine-tuned models from Hugging Face, or your own. Higher accuracy for specific threat categories; more expensive.
4. LLM constructs: Write a prompt and use an LLM as the detection engine itself. Highest accuracy, slowest, most expensive.

Detection efficacy increases down the list, but so do time and cost. The practical recommendation is defense-in-depth layering across these construct types.

Defense-in-Depth Layering: The ClickFix Example

Nabeel demonstrated the layered approach with ClickFix — a real social engineering attack increasingly being weaponized to deliver malicious agent skills. The SCIARA rule for ClickFix combines three layers:

▶ Watch: Defense-in-Depth Layering (6:00)

The experimental results quantify the value of each layer. In a test set of 500 pages:

• String rules (YARA): 230/500 detections (46%) at 0.01ms per page
• Similarity (SBERT): 10 additional unique detections at 12.68ms per page
• Classifier (fine-tuned DeBERTa): 195 additional unique detections at 111.34ms per page

Using only the YARA string rule misses about half the threats. Using only the classifier catches most, but at significantly higher cost. The layered approach — OR conditions where cheaper rules run first — achieves broad coverage while keeping the expensive components reserved for cases the cheap ones miss.

"The detection efficacy increases as you use these different models, but at the same time, it also increases your time and cost. So just like in security, we use defense in depth — our recommendation here is to use a mix of these techniques so that you balance the efficacy and the detection cost and time."

The Pre-Filtering Pattern: 99% Cost Reduction

The most striking data point in Nabeel's talk concerns the pre-filtering pattern — a specific way of structuring AND conditions to gate expensive operations behind cheap ones.

▶ Watch: Pre-Filtering Pattern (8:00)

The motivation: brand impersonation detection. Brand impersonation has never been easier with GenAI, and as agents increasingly communicate with each other, agent-impersonating-agent attacks are expected to grow. The detection rule combines a cheap classifier (pre-filter with high recall but acceptable false positives) with an LLM rule as the secondary confirmation.

The numbers from a 10,000-URL test batch:

• LLM operation: ~4.5 seconds average per item
• Classifier: ~0.5 seconds per item
• Processing 10,000 URLs with LLM-first approach: hours
• Processing 10,000 URLs with pre-filtering: minutes

Cost comparison using Gemini 2.5 Pro:

• Without pre-filtering (LLM for every URL): $750
• With pre-filtering (classifier gates, LLM only for survivors): $13.50
• Cost reduction: ~98.2%

At Palo Alto scale — millions of URLs per day — the LLM-first approach is completely unworkable. Pre-filtering is not optional; it is the only path to economically viable large-scale GenAI threat detection.

"Always pre-filter before you call expensive detection methods."

The SCIARA Library Architecture: Pluggable Everything

▶ Watch: Library Architecture (12:00)

SCIARA follows a flexible factory-pattern philosophy where every component is swappable:

Cleaners: HTML documents contain a lot of decorative noise that semantic models don't benefit from. Standard cleaners strip HTML, extract meaningful content, and prepare it for matching. Custom cleaners can be plugged in.

Chunkers: When matching long documents against a semantic rule, scoring the entire document against a short phrase produces very low similarity scores. Chunking by sentence, paragraph, or using overlapping windows dramatically improves recall. Chunker selection is specified in the rule itself — no changes to detection logic required.

Models: Any publicly available LLM (Gemini, OpenAI, or self-hosted via Ollama) works as the LLM construct, as long as it conforms to the interface contract. Same for classifiers and similarity models. Models and LLMs are preloaded into global memory at initialization — not reloaded for every rule execution, which is critical for performance at scale.

The rule engine is optimized so that in OR conditions, the cheapest rule executes first. AND conditions require both to execute, but the engine still manages the sequencing to minimize unnecessary calls.

The entire library is open source:

• Install: pip install sciara
• Documentation, example rules, and demos: sciara.org

Notable Quotes

"The new binary is natural language. It's no longer PE files or scripts." (0:30)

"Catching all the variants of prompt injection with traditional YARA string matching is a losing battle." (2:30)

"Using this pre-filtering approach, we went from hours to minutes. And this is only ten thousand. Think about millions of URLs each day — this would be a huge bottleneck if we just throw in the most expensive operation." (10:00)

"Always pre-filter before you call expensive detection methods." (10:30)

Key Takeaways

• Natural language is the new executable. Byte-level detection tools like YARA are insufficient for GenAI threats like prompt injection, ClickFix, and brand impersonation. Semantic understanding is required.
• SCIARA/SuperYARA brings familiar YARA syntax to the semantic domain. Security practitioners who know YARA can write semantic rules with a minimal learning curve, specifying detection intent in natural language rather than regex patterns.
• Layered defense-in-depth combines string, similarity, classifier, and LLM constructs. Each layer catches what the previous one misses, while OR-condition optimization ensures cheap rules run first.
• Pre-filtering delivers ~99% cost reduction. Gating expensive LLM calls behind cheap classifiers transforms multi-hour batch jobs into minutes, and reduces per-batch costs from hundreds of dollars to tens of dollars.
• Models and LLMs are pluggable. Any Gemini, OpenAI, or Ollama-compatible model works as the LLM construct. Any Hugging Face classifier works as the classifier construct. Custom chunkers and cleaners can be substituted without touching detection logic.

Slides Reference

Slides are available as 2026-04-04-D1-S2-12-04-Detecting-GenAI-Threats-at-Scale-with-.pdf. Key slide topics include:

• Detection accuracy comparison table: YARA RegEx vs. SCIARA Similarity across six injection types
• ClickFix layered SCIARA rule with three-layer defense combining strings, similarity, and DeBERTa classifier
• Unique detection counts per rule type: Strings 230/500 (46%), Similarity 10 additional, Classifier 195 additional
• Cost comparison: $750 vs. $13.50 for 10,000 URLs with/without pre-filtering
• Pre-filtering AND condition pattern with 95%+ reduction in cost