Model Lifecycle Management & Change Control · Model Authorization & Integrity
Sign every model artifact
Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.
OWASP AISVS v1.01, requirement 3.1.2
In plain English
Sign every model artifact so you can prove who produced it and that it has not changed since. That means weights, configuration files, tokenisers, base models, fine-tunes, adapters and safety models. Each of them can change how the system behaves.
What good looks like
- Every artifact type listed in the requirement is signed, and the signature covers all files in the model package.
- Signing is done by an authorised build pipeline or a small named group. Individual laptops hold no signing keys.
- Signatures are stored with the artifact and referenced from the model registry.
- Third-party models are signed by you at the point you approve them for use.
How teams usually do it
- Sigstore tooling in the packaging pipeline. The OpenSSF Model Signing project (model-signing) signs a whole model directory as one unit.
- Keys held in a key management service or HSM and used through the pipeline's identity, or keyless signing tied to that identity.
- Packaging models as OCI artifacts in a container registry and signing them with cosign, so existing container tooling applies.
Suggested evidence
- Signatures stored with the artifacts.
- Key access policies showing which identities can sign.
- Pipeline logs for a recent signing event.
Common mistakes
- Signing the weights and leaving out the tokeniser or configuration, which can change behaviour just as much.
- Signing keys on a developer's laptop.
- Signing whatever the pipeline is handed, with no check that it came from an approved training run.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.