ML Model Signing: Cryptographically Paving the Way to Provenance in Machine Learning Models
summary
An open source library creates a signed manifest of every file or hash shards inside an ML model, converts that manifest to an in-toto payload and records the signature and inclusion proof in Sigstore, enabling offline verification. Demo signs a 3 GB Hugging Face model, hashes with SHA-256 and BLAKE2, and shows hashing takes ~12–16s versus a de-sum style approach at ~24–30s. Verification succeeds for intact models and fails when a file is removed; checkpoints, multiple formats and streaming/incremental hashing are implemented or planned.
AI-written summary · about
chapters (8)
- 0:00Introduction to model signing
- 1:05Problem and solution overview
- 2:49Challenges in model signing
- 7:21Library architecture and layers
- 8:27Demo signing a model
- 13:07Performance comparisons
- 16:02Future plans and integrations
- 17:26Conclusion and Q&A
related talks
23mEnd-to-End Secure ML Development
25mFrom Model To Trust: Building Upon Tamper-proof ML Metadata Records
19mModel transparency for AI/ML security
27mTaming the Wild West of ML: Practical Model Signing with Sigstore on Kaggle
26mTaming ML’s Wild West: Practical Model Signing with Sigstore on Kaggle
21mEnd-to-end secure ML Development
31mBuilding Trust in ML: Mapping the Model Lifecycle for ML Integrity and Transparency
36mShift-Left for LLMs: Securing the AI Model Supply Chain