Skip to content
Vraelis homeDocs
Join us

Model integrity

View as Markdown
Join usMeet Vraelis Contour

Whether the model that runs is the model that was approved. A research area, not a product.

Research area

This is a research area, not a product. Where it mentions Vraelis Contour, it says what exists in the experiment and what is proposed.

What we study

Four questions about one release.

What exactly is a release?
The model, its preprocessing and its configuration, each by digest.
What should an approval bind to?
One release and one destination, so it cannot travel elsewhere.
What can a runtime report about itself?
Which release it loaded. A self-report, without hardware attestation.
What does a signature prove?
An endorsement of bytes. Not intended behaviour, not the absence of a backdoor.

What exists today

Where Vraelis Contour starts.

  • Working in the experimentArtifact integrity: model bytes checked against the approved digest before a session loads them.
  • Working in the experimentRelease authorization: signed bindings to the exact release and destination, with a 60 second age limit.
  • Working in the experimentRuntime policy checked before serving: ONNX Runtime 1.23.2, CPUExecutionProvider only.
  • Working in the experimentConfiguration integrity: the configuration digest is part of the release, compared on every report.
  • Measured133 of 133 experiment tests at the runtime rejection-diagnostics revision, in the pinned network-disabled harness, reproduced by internal automated testing on a separate build on October 10, 2026 (Pacific). Not production readiness.
  • ProposedPreprocessing identity. Not recorded yet.
  • Not claimedHardware attestation. Runtime identity is a worker self-report.
Release identity for cpu-2: model, configuration, release and receipt digests; preprocessing not recorded.
Read-only evidence app, inside the controlled ONNX reference experiment.

What is still open

Naming preprocessing
How to identify tokenizers, scaling and feature code by digest.
More than one runtime
Other runtimes and accelerators. No adapters are built.
Model provenance
Where a model and its training inputs came from, beyond its digest.
A compromised host
Its self-report can say anything. Outside the experiment.

How it connects to Vraelis Contour

Draws on directly: Release identity, bound approval, approved against reported.

On vraelis.com: Model integrity, How Vraelis Contour works, Suppliers and integrators.

Security evidenceRecords a person can read, kept in order, including what could not be confirmed.ReadMachine trustExplicit identity, limited permissions and checks at execution boundaries.ReadAdversarial threatsInputs, updates and supply paths built to change what a model does.Read

Last updated: October 10, 2026