Summary

Any model verifier whose decision resolves a candidate against a reference or trust anchor inherits the authenticity assumptions of that anchor. This holds for artifact signing, behavioral fingerprinting, reference-anchored activation auditing, and structural identity measurement alike, and it bounds each of them by a question none answers internally: was the reference itself authentic?

This note makes that boundary explicit. It separates two assertions that are routinely conflated, states the failure that exploits the gap between them, argues that the gap is a property of the verification problem rather than of any particular method, proposes a graded vocabulary for describing how strongly an enrollment is rooted, and addresses what remediation looks like when a root is found to be bad.

The note reports no new measurement. Its contribution is a distinction, a vocabulary, and a remediation model. We publish it because a shared name for this boundary is more useful to the field than each method discovering it independently in its own limitations section.

§1 Two assertions

A verification system that reports “this model is X” is usually compressing two separate claims into one sentence.

Assertion A — identity continuity. The model performing computation now corresponds to the model enrolled under reference record R.

Assertion B — enrollment provenance. Reference record R corresponds to the authentic release of X by its stated publisher.

These have different evidence types and different failure modes. Assertion A is answerable by measurement: one compares a property of the running model against the property recorded at enrollment, against a stated acceptance criterion. Assertion B is not answerable by measurement of the model.

The precise form of that limitation matters. It is not that no observable property of a model could ever be publisher-associated — a publisher could deliberately embed a watermark or a signature-bearing signal. It is that any such signal only becomes evidence of authorization through an externally established binding between the signal and the publisher. An embedded signature requires a trusted public-key-to-publisher mapping; a watermark requires a trusted statement that the watermark is the publisher’s. Observation of the artifact can carry the binding but cannot originate it. Legal and organizational authorization is introduced from outside the model and must be carried by evidence of a different class.

Our earlier work already noted that structural identity does not itself establish organizational ownership, and that establishing it requires an external registry or certificate chain.12 This note promotes that observation to a first-class architectural concern, because the field has begun to encounter it from several directions at once.

The distinction generalizes one drawn in Agent Identity Is Not Model Identity:3 there, a valid credential established that some party held a credential, not that the model behind the endpoint was the model named. Here, a valid measurement establishes that the running model corresponds to an enrolled reference, not that the enrolled reference was authentic. In both cases the verification is sound and the conclusion the operator draws exceeds it.

§2 The poisoned enrollment

The failure that exploits the gap requires no cryptographic break and no adversarial optimization. It follows from the threat model by construction.

Let M0 be the authentic release of model X and M1 a substituted artifact. Suppose an adversary controls the distribution path before enrollment. The verifier obtains M1, believes it to be X, and enrolls it: 

R          :=  enroll(M1)
label(R)   :=  "X"

At every subsequent verification the running model M1 is resolved against R and satisfies the acceptance criterion. The verifier reports continuity, correctly. Every downstream policy decision keyed to “is this X?” resolves in the adversary’s favour — until the enrollment is independently challenged, revoked, or superseded — with no further adversary action required.

The failure lives entirely in label(R) = "X". It does not live in runtime ≈ R. The measurement can be operating exactly as specified, and the continuity decision can be correct, while the attribution remains false. This is not a false accept in the measurement sense.

Two properties make it worth naming. First, it is silent: nothing in the verification record indicates that anything is wrong, so the failure produces confident output rather than an error. Second, it is self-sustaining: unlike substitution at inference time, which the adversary must maintain against every subsequent verification, a poisoned enrollment need happen once and is thereafter internally consistent.

Silent, self-sustaining, confidently-reported failures are the class we have found most costly elsewhere in this program. The remediation pattern is consistent: validate at the layer where the failure occurs, not at the layer where the symptom appears.

§3 The gap is field-wide, not method-specific

This is not a defect in any one approach. Four model-identity methods reach the same boundary from different directions, and the neighbouring discipline of software supply-chain security reached it first.

Software supply-chain provenance.

SLSA treats provenance as an attestation whose verification begins by comparing the artifact to its provenance and the provenance to a preconfigured root of trust, and advises verifiers to consider carefully which build platforms are admitted to those roots.4 It is explicit that the builder identity represents the transitive closure of all entities trusted to faithfully run the build and record the provenance,5 and that consumers cannot trust a platform to produce its highest build-level guarantees without independent proof that the provenance is unforgeable and the builds isolated.6 It also recommends signing methods that improve the ability to detect and remediate key compromise — relying on transparency logs, or on timestamp services where a transparency log is inappropriate7 — which is an acknowledgement that signing alone does not make compromise visible.

The SolarWinds Orion compromise is the canonical demonstration of the consequence. A backdoored component was introduced into the vendor’s software lifecycle and was subsequently signed with the legitimate vendor code-signing certificate, then distributed through normal release channels.8 The signature authenticated the artifact under SolarWinds’ signing authority. It did not establish that the process producing that artifact had remained uncompromised.

None of this is novel, and we do not claim it is. It belongs to a security-engineering tradition that long predates model-identity systems. The observation of this note is that model-identity systems inherit the identical constraint, and that the consequence has not been made explicit at the specific boundary between enrolled model identity and runtime structural measurement.

Reference-anchored activation auditing.

Hurtado’s two-signal checkpoint audit9 scores a candidate against a base or sibling reference, combining a reference-anchored activation refusal-gap with a weight-recovery energy over the base-to-candidate difference. The paper maps its own failures with unusual candour and ranks first in severity the case where the declared reference is itself adversarial: declaring an already-modified sibling evades both axes with no training, and using the candidate as its own reference evades by construction (ΔW = 0, ρ = 1). Its conclusion is explicit — the root of trust must be a publisher-signed checkpoint hash or hardware-attested lineage, not an uploader-nominated base.

Artifact signing.

Signature-based verification establishes that a party holding a key attested to a set of bytes. It does not establish that the key-holder was the authentic publisher, nor that the signing infrastructure was uncompromised at signing time.

The July 2026 intrusion at Hugging Face illustrates the general shape of the risk, and precision about what it did and did not involve is essential. An autonomous agent obtained node-level access and credentials inside the platform’s production infrastructure, and among the credentials obtained was a service identity-token signing key — not a model-artifact signing key — sufficient to mint correctly signed identity tokens.1011 Separately, write access to some internal source repositories was obtained and used. The platform reported that no unauthorized change shipped, verified published packages and container images against expected digests, reported that the Hub database was not reached, and reported no evidence of tampering with public models, datasets or Spaces.1012

We cite this not as evidence that model artifacts were altered — the platform’s negative findings on that point are clear and we do not dispute them — but for the narrower and better supported observation that valid credentials existed, briefly, in unauthorized hands inside a major distribution platform. A root anchored inside a distribution boundary inherits that boundary’s compromise modes. That is a statement about architecture, not about this platform, which disclosed quickly and in technical detail — the behaviour the field should want.

Behavioral fingerprinting.

Methods characterizing a model by its input-output behavior compare a candidate’s fingerprint against a reference fingerprint derived from an artifact obtained somewhere. The question applies unchanged.

Structural identity measurement,

our own method, is not exempt. A structural anchor is derived from an artifact obtained at enrollment. If that artifact was inauthentic, the anchor is a valid structural reference for the wrong model.

Five methods, one shared boundary, and a prior tradition that named it in another domain. That is the signature of a property of the problem.

§4 Root placement changes the attack surface

A shared boundary does not imply identical exposure. But the difference is best stated as an elimination of one attack path, not as a general claim about attacker cost — a poorly protected issuer key may well be easier to compromise than a tightly controlled per-audit reference. The load-bearing axis is when the reference is fixed, and who may nominate it.

A reference nominated per audit, by the party submitting the candidate, is exposed continuously and cheaply. Every audit is an opportunity, no compute is required, and a successful evasion is not distinguishable from an honest audit by inspection of the audit alone. This is the failure Hurtado ranks first in severity, and it is a property of the deployment pattern rather than of the underlying signals.

Fixing the reference before verification — signed under a stable issuer key, timestamped, published, independently recomputable by any party holding the claimed artifact, and preferably committed to a transparency log — removes attacker-controlled per-audit reference nomination as an available attack path. The attacker can no longer select a favourable reference at verification time. The remaining attacks must target the enrollment itself, by poisoning the artifact before it is enrolled, or the infrastructure that binds enrollments to an issuer.

That is close to tautological, which is exactly why we state it that way. We are deliberate about what it does not claim. It does not claim the remaining paths are harder in general. Compromise of a signing key is not necessarily promptly detectable, and a forged signature can appear entirely legitimate until the compromise is discovered by other means. Signing does not make compromise self-evident. What a published, timestamped, transparency-logged commitment provides is an observable record against which a later investigation can establish what was asserted and when — a detection-and-remediation property, not a prevention property, and the same rationale supply-chain guidance gives for recommending transparency logs.7

How much harder the remaining paths are is an open question (§8), and we do not answer it here.

§5 Enrollment assurance profiles

“Enrolled” is not a single condition. We propose a vocabulary, defined compositionally so the ordering relations are true by construction. The profiles are independent of measurement method: any verification approach can be described in these terms.

These are profiles, not a totally ordered ladder. E0 ≺ E1 ≺ E2 holds by construction. E3 and E4 both strictly contain E2 and are incomparable to each other: origin enrollment does not provide independent corroboration, and corroboration across several distribution paths does not protect against a common poisoned upstream. Which is preferable depends on the threat. A verifier concerned with distribution-path compromise should require E3; a verifier concerned with distributor substitution should require E4; a verifier concerned with both should require both. There is no “E3-or-better” — in a partial order that phrase does not denote.

Two further properties deserve emphasis.

The ceiling is honest. Even E4 does not make identity self-certifying. It relocates the trust assumption to the publisher’s release process, which is the narrowest place we know how to put it, not the elimination of the assumption.

A lower profile is not a defect. Our own published records are presently E1 under this vocabulary, and E1 is a reasonable basis for many purposes. What is not reasonable is reporting an E1 enrollment in language that implies E4. The purpose of the vocabulary is to make the claim match the evidence.

§6 Remediation: what happens when a root is found to be bad

A vocabulary for assurance is incomplete without a model for what follows discovery. The critical requirement is that remediation must not infer more than the evidence warrants — the same discipline the rest of this note argues for, applied reflexively.

Two discovery events are commonly conflated and are not epistemically equivalent.

Confirmed poisoned enrollment. Evidence establishes that the artifact enrolled under X was not the authentic publisher release at the time of enrollment. Attribution is FALSE. Every verification performed against that enrollment was correct as to continuity and false as to attribution. The enrollment is revoked.

Note the boundary: an artifact substituted in storage after a correct enrollment is a different failure entirely. It does not make the original attribution false, and it is precisely what continuity verification is for.

Root or key compromise without enrollment-specific evidence. A publisher key, issuer key, or distribution path is discovered to have been compromised during a window covering the enrollment, but no evidence establishes that this particular enrollment was forged. Attribution is not shown false — it is no longer supported. Attribution is INDETERMINATE; the assurance basis is revoked. Restoring it requires re-establishing provenance through an uncompromised path, not a declaration.

Collapsing the second case into the first over-invalidates: it discards attributions that may be perfectly sound, and it treats an absence of assurance as a presence of falsity. Collapsing the first into the second under-invalidates.

Three further consequences follow.

Invalidation is retroactive in attribution and not in continuity. The historical record of continuity verifications remains factually accurate: those models did correspond to that reference. What changes is the label, or the confidence in it. Continuity evidence is historical evidence; attribution assurance is revocable interpretation over that evidence. Systems that conflate the two cannot express the distinction.

Records should transition, not disappear. Deleting a compromised enrollment destroys exactly the evidence an investigation needs. Lifecycle state transition — with the historical record persisting and independently verifiable — preserves auditability.

Downstream policy must be able to re-evaluate. An organization that issued access decisions on the strength of a now-revoked enrollment needs to enumerate them. That is only possible if the assurance basis was recorded in the attestation at issuance rather than assumed.

Which suggests a design consequence, offered as a proposal rather than a specification. Enrollment provenance has two properties that must both be representable: the profile under which it was originally established, and its current attribution state. A profile alone cannot express that an E2 enrollment has since been invalidated. So a verification attestation may need to carry two distinct evidentiary objects rather than one verdict. Not 

model_identity: X
result: VERIFIED

but, illustratively, 

structural_verification: VERIFIED
enrollment_provenance:
  profile:            E2
  attribution_state:  SUPPORTED     # or INDETERMINATE, or FALSE

A policy engine can then express what an organization actually means — a production workload in a regulated context requiring structural verification together with E3, or E4, or both, and an attribution state of SUPPORTED; a research workload accepting E1; a sovereign deployment requiring origin enrollment together with confidential runtime measurement. A single green check mark cannot express any of that. It silently averages two independent assurances into one, and it has no way to represent the INDETERMINATE state — which is precisely the state an organization most needs to see, because it is the one that calls for review rather than either confidence or alarm.

We are not proposing a schema. We are observing that the boundary described in §1 has a representational consequence, and that collapsing it into one field is a design decision with costs that should be taken deliberately.

§7 What this changes, and what it does not

It does not change the measurement claims. Structural identity — the stability of a model’s internal activation geometry across the tested fine-tuning, quantization and distillation regimes, and its sensitivity to directional weight modification — is a property of the artifact measured. Those results stand exactly as published.131415

It does not change identity continuity. Once a model is validly enrolled, verifying that the running model corresponds to its enrolled reference requires nothing further from the distribution platform: no subsequent call to a repository, no dependence on that repository’s continued integrity or continued existence. That independence is a security property worth stating plainly and is unaffected by anything here.

It changes what a verification result should be read to assert. The bounded claim is:

Verification establishes that the model performing computation corresponds to the enrolled reference. Authentic attribution of that reference to a named publisher is a separate assumption, whose strength is stated by the enrollment profile, whose current standing is stated by the attribution state, and whose evidence is external to the measurement.

This is a smaller claim than the field often implies, and considerably harder to attack.

§8 Open problems

Quantifying root exposure. §4 establishes that fixing the reference before verification eliminates one attack path. It does not establish how much harder the remaining paths are. We do not provide such a quantitative model here, and we think one would be a genuine contribution.

Retroactive corroboration. Independently signed structural references captured at different times by different parties constitute, collectively, a weak form of E3 obtainable after the fact. We have not evaluated retroactive corroboration in this framework; its practical achievability and its guarantees in this setting remain open.

Detection-aware evasion. Distinct from the enrollment root, and equally open: whether an adversary optimizing directly against a structural fingerprint can evade it while preserving capability and coherence. Hurtado demonstrates this against his own detector, bounded explicitly to one family and scale, and identifies the question as unresolved for concurrent methods including ours.9 Our published work reports the unconstrained case: direct gradient targeting of the structural observable moved the fingerprint approximately 42 times the measurement noise floor within a model family — against a same-family separation of roughly 1,200 times that floor — and, across families, achieved substantial distance reduction only while degrading the model to six times baseline perplexity.13 That same work reports that the task-constrained regime was tested and returned inconclusive results, because the evaluation protocol could not distinguish genuine capability retention from overfitting to the evaluation data.13 The task-constrained regime is the one of practical interest, and the one Hurtado’s attack occupies. We treat it as open and intend to evaluate it under pre-registration, with capability and coherence constraints stated in advance.

Origin enrollment in practice. E4 requires publisher participation. What a release-time enrollment ceremony would need to look like to be acceptable to a frontier laboratory is a design problem, not a research problem, and we have not solved it.

§9 Epistemic status

Following the classification used throughout this program:

Claim Status
Structural identity is stable across the tested fine-tuning, quantization and distillation regimes VALIDATED
Directional weight modification is structurally detectable across tested families VALIDATED
Unconstrained gradient targeting produces small within-family fingerprint movement VALIDATED
Assertion A and Assertion B are distinct and require different evidence classes DERIVED
A reference-resolved verifier accepting a poisonable enrollment without independent provenance validation can correctly verify continuity to an incorrectly attributed reference DERIVED
Fixing the reference before verification eliminates per-audit reference nomination as an attack path DERIVED
How much harder the remaining attack paths are OPEN
The E0–E4 profiles are the right decomposition PROPOSED
Enrollment provenance requires both a profile and an attribution state to be representable PROPOSED