Implementation guide
OWASP AISVS v1.01
Supply Chain Security for Models · Model Artifact Integrity
Verify third-party model files
Verify that every third-party model artifact can be integrity-verified.
OWASP AISVS v1.01, requirement 6.1.3
In plain English
For every third-party model file, you should be able to check that it is exactly what the publisher released and exactly what you approved. If you cannot verify a file, you cannot know whether it was swapped on the way to you or after it arrived.
What good looks like
- Publisher signatures or checksums are verified at download.
- Where the publisher provides none, you record your own SHA-256 hash at approval and check against it from then on.
- Models are referenced by immutable identifier (commit hash or digest) in configuration.
- The check runs again before deployment.
How teams usually do it
- Verify publisher signatures in the import step where they exist, for example Sigstore-based model signatures.
- Pin by revision hash when pulling from a hub, and record file hashes in your model registry.
- Store approved artifacts in an internal registry that addresses them by content hash.
Suggested evidence
- Recorded hashes or signatures for each third-party artifact.
- Verification logs from import and deployment.
- Configuration showing models pinned by hash.
Common mistakes
- Pinning a model by name and tag, which the publisher can repoint at different files.
- Verifying at download and never again, though the file then sits on shared storage for months.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.