Implementation guide
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Model Authorization & Integrity
Verify model signatures before use
Verify that model cryptographic signatures are verified at deployment admission and on load.
OWASP AISVS v1.01, requirement 3.1.3
In plain English
Check a model's signature when it is admitted to an environment and again each time it is loaded, and refuse anything that fails. The second check matters because a file can be swapped on disk after it passed the first.
What good looks like
- Deployment admission rejects unsigned artifacts and those signed by an unapproved identity.
- The serving runtime verifies the signature or hash at load time, including on restart and scale-out.
- A verification failure stops the load and raises an alert.
- The list of trusted signers is itself controlled and reviewed.
How teams usually do it
- A pipeline step or Kubernetes admission controller (for example Kyverno or the Sigstore policy controller) that verifies signatures before deployment.
- A small wrapper in the serving code that verifies the artifact before handing it to the model loader.
- Read-only model volumes, so a verified file cannot be changed afterwards.
Suggested evidence
- The admission policy configuration.
- A test showing that a tampered or unsigned artifact is refused at admission and at load.
- A sample alert from a failed verification.
Common mistakes
- Verifying in the pipeline only, so a file swapped on disk is still loaded.
- Logging a failed check as a warning and loading the model anyway.
- Checking that a signature exists without checking who made it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.