Model artifact provenance

A cryptographic digest gives a stable identifier for particular bytes under the hash function's security assumptions. Comparing an artifact to a digest supplied beside it by the same untrusted source does not authenticate its origin. A signed statement can bind an identified signer to a digest, but the verifier must validate the signature, trust roots, identity constraints, and relevant verification-time evidence rather than accepting a decorative signature field.

Create a release manifest covering every behavior-relevant asset, including tokenizer files, adapters, inference configuration, and any code needed for loading. Use immutable identifiers for referenced objects and check them before activation. Safe serialization formats and restricted loaders reduce a separate execution risk. A correctly signed archive can still contain malicious or vulnerable code if an authorized producer included it.

SLSA provenance records how an artifact was produced, with a build definition, dependencies, and run details. An AI release can additionally link dataset manifests, training configuration, evaluation reports, and checkpoint lineage. These links are evidence with their own trust and availability requirements. A dataset digest does not prove consent or label quality, and a reproducible build does not make an unreviewed training recipe acceptable.

Write acceptance policy before consuming an artifact: expected producer identity, allowed source revision, approved build process, required evidence, and prohibited mutable dependencies. Sigstore verification supports checking signatures against identity and issuer expectations. Verification must happen where it can block use; a warning in a dashboard is insufficient if a serving process already loaded the unverified model. Cache verified artifacts by immutable identity, with a plan for revoking previously accepted releases.

Record the verified release identity in each deployment and attach the actual runtime configuration. This makes it possible to answer whether a suspicious output came from a candidate, a rollback, or an undocumented adapter. Preserve verification evidence according to retention and privacy policies, while avoiding secrets in manifests. An audit trail should survive ordinary restarts and distinguish artifact acceptance from subsequent configuration changes.

Replication improves availability of artifact stores but does not create independent trust. Five replicas containing the same substituted file remain five copies of the wrong file. Separate publishing authority from serving authority, restrict who can update acceptance policy, and test rejection of wrong identities and changed bytes. A verification outage needs a deliberate policy for already verified artifacts; silently bypassing validation during an incident defeats the boundary precisely when it matters.