Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · Edge & Distributed AI Security
Sign models shipped to devices
Verify that models deployed to edge or mobile devices are cryptographically signed during packaging, and that the on-device runtime validates these signatures or checksums before loading or inference.
OWASP AISVS v1.01, requirement 4.3.2
In plain English
Sign models before you ship them to phones or edge devices, and have the device verify the signature before it loads one. A device in the field cannot assume the model file it holds is the one you sent.
What good looks like
- Models are signed in the release pipeline when they are packaged.
- The on-device runtime checks the signature or checksum before loading and before the first inference.
- An unsigned or altered model is refused, and the device reports the failure.
- Model updates delivered over the air go through the same check as models shipped in the app.
How teams usually do it
- Sign in the release pipeline with a key held in a key management service, and build the public key into the app or firmware.
- Verify on load, and again after any update download.
- Where the platform signs the whole app package, add a separate model signature for models downloaded after install.
Suggested evidence
- The signing step in the release pipeline.
- The on-device verification code.
- A test showing an altered model is refused.
Common mistakes
- Downloading model updates over HTTPS with no signature check. HTTPS protects the transfer and says nothing about the file on the server or on the device afterwards.
- Verifying a checksum that was downloaded from the same place as the model.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.