Model integrity
Know which model is running.
Whether the model that runs is the model that was approved. A research area, not a product.
What we study
Four questions about one release.
What exactly is a release?
The model, its preprocessing and its configuration, each by digest.
What should an approval bind to?
One release and one destination, so it cannot travel elsewhere.
What can a runtime report about itself?
Which release it loaded. A self-report, without hardware attestation.
What does a signature prove?
An endorsement of bytes. Not intended behaviour, not the absence of a backdoor.
What exists today
Where Vraelis Contour starts.
- Working in the experimentArtifact integrity: model bytes checked against the approved digest before a session loads them.
- Working in the experimentRelease authorization: signed bindings to the exact release and destination, with a 60 second age limit.
- Working in the experimentRuntime policy checked before serving: ONNX Runtime 1.23.2, CPUExecutionProvider only.
- Working in the experimentConfiguration integrity: the configuration digest is part of the release, compared on every report.
- Measured133 of 133 experiment tests at the runtime rejection-diagnostics revision, in the pinned network-disabled harness, reproduced by internal automated testing on a separate build on October 10, 2026 (Pacific). Not production readiness.
- ProposedPreprocessing identity. Not recorded yet.
- Not claimedHardware attestation. Runtime identity is a worker self-report.
Open questions
What is still open.
Naming preprocessing
How to identify tokenizers, scaling and feature code by digest.
More than one runtime
Other runtimes and accelerators. No adapters are built.
Model provenance
Where a model and its training inputs came from, beyond its digest.
A compromised host
Its self-report can say anything. Outside the experiment.
Study these problems with us.
For researchers and academic teams.