AFIRM

P04

T0402 — Model Identity & Provenance Verification

Demonstrated (per sub-technique; .001 Established mechanics. Method families have different evidence bases and none has forensic validation.)

Sub-techniques

  • T0402.001 — Cryptographic Package Identity & Attestation Verification
  • T0402.002 — Parameter-Space Fingerprint Comparison
  • T0402.003 — Representation/Activation Fingerprinting
  • T0402.004 — Behavioral Fingerprinting
  • T0402.005 — Watermark / Registered-Signal Verification

Description

Model Identity & Provenance Verification addresses several distinct forensic propositions that must not be collapsed into one "identity" question, because they require different evidence and have different error structures — exact artifact identity/integrity (an equality/cryptographic-verification question: digests, signatures, manifests, attestations, not a similarity judgment), deployment identity (whether the signed/approved artifact was actually loaded and executed), lineage/derivation (whether a model is derived from a claimed ancestor, inferred from parameter, representation, or watermark evidence), behavior source attribution (whether a particular model/system produced an observed output — inferential, interface-compatible, and weakest), and ownership-signal verification (whether a pre-registered watermark or fingerprint verifies under a stated scheme). Exact identity is often stronger and simpler than any heuristic similarity where organizations sign and attest their model packages: where model signing, attestation, and AI BOMs exist, the cryptographic sub-technique answers the identity question by verification rather than by comparing statistical invariants, so AFIRM orders the sub-techniques to consider the cryptographic path first and reach the inferential paths — parameter, representation, behavioral — only when it is unavailable. An examiner reaches for this technique in provenance disputes, deployment-integrity questions, and as a prerequisite step for other Analysis techniques whose interpretation depends on knowing the identity of the artifact under analysis. The output is always a proposition-specific finding with stated evidence and limits, never a bare assertion of "same model."

Notes

Separates propositions: exact artifact identity/integrity . deployment identity . lineage/derivation . behavior source attribution . ownership-signal verification. Cryptographic identity/attestation is the first sub-technique.

Metadata

Phase P04 — Analysis
Evidence classes EC01 — Live model & session state, EC02 — Runtime telemetry & interaction logs, EC05 — Model artifacts at rest
Access capability W / G / B
Capability/coverage only — not a claim-strength scale.
Status active

Claim & Validation Profile

Does establish

  • cryptographic (.001): exact match to a registered package, and with attestation, that it was the loaded artifact
  • parameter/representation (.002/.003): derivation inferences supported by stated similarity evidence
  • behavioral (.004): consistency with shared ancestry
  • watermark (.005): verification under the scheme's stated soundness

Does not establish

  • cryptographic (.001): derivation of an unsigned model, or anything about behavior
  • parameter/representation (.002/.003): unique derivation, especially under laundering
  • behavioral (.004): does not distinguish shared ancestry from shared training data or common-source distillation
  • watermark (.005): verification does not extend beyond the transformations the scheme is proven to survive

Alternative propositions & corroboration

  • behavioral similarity may reflect shared training data or common-source distillation rather than derivation
  • parameter/representation similarity may reflect convergent training rather than derivation

Quality controls

  • prefer the cryptographic path (.001) where signing/attestation exist
  • present any derivation or source opinion as expert similarity analysis with disclosed limitations

Case-specific limitations & stop conditions

  • never present a derivation/source opinion as identification to the exclusion of all other models

Admissibility is not stated here — see the Evidentiary Standard Assessment (T0502) jurisdiction overlays.

Forensic Readiness Measures

ID Measure Relationship
R0005 Model Signing, Attestation & Provenance Registration enabling
R0011 Reproducible AI Deployment Manifest / AI BOM strengthening
R0002 Model Checkpoint & Version Archiving strengthening

References

  1. CoSAI Open Model Signing (citation pending verification)
  2. SLSA provenance (supply-chain attestation) (citation pending verification)
  3. SPDX AI BOM guidance (citation pending verification)
  4. HuRef — parameter invariants of LLMs (citation pending verification)
  5. REEF — representation-encoding fingerprints (citation pending verification)
  6. Uchida et al. — embedding watermarks in DNN weights (citation pending verification)
  7. Model-laundering / provenance-obfuscation literature (citation pending verification)
  8. ISO/IEC 27037 — integrity discipline

Case Applications

No published case applications yet.