AFIRM

P03

T0303 — Weight & Checkpoint Differential Analysis

Demonstrated (forensic-incident framing is AFIRM’s extension over demonstrated adjacent-domain mechanics)

Description

Weight & Checkpoint Differential Analysis compares a questioned model artifact against an authenticated known-good reference to determine whether parameters differ, and if so where and by how much — the AI analogue of binary differential analysis in classical software forensics. The output is a delta map. As an Examination-phase technique its job ends at producing an accurate, repeatable account of what differs; interpreting why the parameters differ is Analysis-phase work (T0406). Results occur at four distinct levels — byte-identical artifact, exact aligned-tensor comparison, normalized-then-compared, and interpretation of a delta's origin — which must not be conflated, since they rest on different assumptions and support different claims.

Notes

Diff questioned artifact vs authenticated known-good reference to localize parameter changes. Four result levels (byte-identical / exact aligned-tensor / normalized-then-compared / interpretation), each supporting different claim strength. Feeds T0406.

Metadata

Phase P03 — Examination
Evidence classes EC05 — Model artifacts at rest
Access capability W
Capability/coverage only — not a claim-strength scale.
Status active

Claim & Validation Profile

Does establish

  • that the compared, successfully aligned tensors are identical or differ
  • where they differ and by what magnitude/distribution

Does not establish

  • that the right artifacts were compared
  • that every deployed component was covered
  • that alignment/normalization was correct
  • that the reference is authentic and approved
  • what a delta means

Alternative propositions & corroboration

  • a localized delta is consistent with both unauthorized modification and legitimate fine-tuning, patching, or optimization
  • a no-difference result is consistent with an unmodified model and with modification confined to components outside the compared package

Quality controls

  • authenticate and verify integrity of both artifacts before comparison
  • document every normalization step and the comparison-tool version

Case-specific limitations & stop conditions

  • stop and report non-comparability where architectures do not align
  • do not extend a package-level no-change result to the deployed system

Admissibility is not stated here — see the Evidentiary Standard Assessment (T0502) jurisdiction overlays.

Forensic Readiness Measures

ID Measure Relationship
R0002 Model Checkpoint & Version Archiving required
R0011 Reproducible AI Deployment Manifest / AI BOM strengthening
R0005 Model Signing, Attestation & Provenance Registration strengthening

References

  1. Model IP-verification literature on parameter-level comparison between base and derived models (citation pending verification)
  2. Fine-tuning delta / task-vector / model-editing literature (citation pending verification)
  3. Backdoor-insertion literature on parameter-space footprints (citation pending verification)
  4. NIST IR 8354 — Digital Investigation Techniques (citation pending verification)
  5. ISO/IEC 27037 — hash verification and integrity discipline

Case Applications

No published case applications yet.