# Model integrity

Whether the model that runs is the model that was approved. A research area, not a product.

> **Research area.** This is a research area, not a product. Where it mentions Vraelis Contour, it says what exists in the experiment and what is proposed.

## What we study

Four questions about one release.

- **What exactly is a release?:** The model, its preprocessing and its configuration, each by digest.
- **What should an approval bind to?:** One release and one destination, so it cannot travel elsewhere.
- **What can a runtime report about itself?:** Which release it loaded. A self-report, without hardware attestation.
- **What does a signature prove?:** An endorsement of bytes. Not intended behaviour, not the absence of a backdoor.

## What exists today

Where Vraelis Contour starts.

- **Working in the experiment:** Artifact integrity: model bytes checked against the approved digest before a session loads them.
- **Working in the experiment:** Release authorization: signed bindings to the exact release and destination, with a 60 second age limit.
- **Working in the experiment:** Runtime policy checked before serving: ONNX Runtime 1.23.2, CPUExecutionProvider only.
- **Working in the experiment:** Configuration integrity: the configuration digest is part of the release, compared on every report.
- **Measured:** 133 of 133 experiment tests at the runtime rejection-diagnostics revision, in the pinned network-disabled harness, reproduced by internal automated testing on a separate build on October 10, 2026 (Pacific). Not production readiness.
- **Proposed:** Preprocessing identity. Not recorded yet.
- **Not claimed:** Hardware attestation. Runtime identity is a worker self-report.

![Release identity for cpu-2: model, configuration, release and receipt digests; preprocessing not recorded.](https://vraelis.com/v8/contour/crop-release-identity.webp)

*Read-only evidence app, inside the controlled ONNX reference experiment.*

## What is still open

- **Naming preprocessing:** How to identify tokenizers, scaling and feature code by digest.
- **More than one runtime:** Other runtimes and accelerators. No adapters are built.
- **Model provenance:** Where a model and its training inputs came from, beyond its digest.
- **A compromised host:** Its self-report can say anything. Outside the experiment.

## How it connects to Vraelis Contour

Draws on directly: Release identity, bound approval, approved against reported.

On vraelis.com: [Model integrity](https://vraelis.com/research/model-integrity), [How Vraelis Contour works](https://vraelis.com/contour#how), [Suppliers and integrators](https://vraelis.com/applications/integrators).

- [Security evidence](https://docs.vraelis.com/security-evidence): Records a person can read, kept in order, including what could not be confirmed.
- [Machine trust](https://docs.vraelis.com/machine-trust): Explicit identity, limited permissions and checks at execution boundaries.
- [Adversarial threats](https://docs.vraelis.com/adversarial-threats): Inputs, updates and supply paths built to change what a model does.

---

Vraelis documentation, Research. https://docs.vraelis.com/model-integrity