Skip to research
Vraelis Research
Model integrity

Know which model is running.

The connection between an approved model release and the identity reported by its runtime.

Research collaborationAll research areas
Approved release cpu-2, generation 2, from the experiment's local release store, whose signatures the experiment checks.Reported loaded release cpu-1, generation 1, a worker self-report.
Approved release: cpu-2, generation 2.Reported loaded release: cpu-1, generation 1.
  • MatchedEvery field of the reported identity equals the approved one.
  • DiffersThe reported identity differs from the approved one. In the recorded run: reload pending.
  • UnavailableNo usable runtime report. Kept as its own result.
What we study

Four questions about one release.

  1. What exactly is a release?

    The model, its preprocessing and its configuration, each by digest.

  2. What should an approval bind to?

    One release and one destination, so it cannot travel elsewhere.

  3. What can a runtime report about itself?

    Which release it loaded. A self-report, without hardware attestation.

  4. What does a signature prove?

    An endorsement of bytes. Not intended behaviour, not the absence of a backdoor.

What exists today

Where Vraelis Contour starts.

  • WorkingArtifact integrity: model bytes checked against the approved digest before a session loads them.
  • WorkingRelease authorization: signed bindings to the exact release and destination, with a 60 second age limit.
  • WorkingRuntime policy checked before serving: ONNX Runtime 1.23.2, CPUExecutionProvider only.
  • WorkingConfiguration integrity: the configuration digest is part of the release, compared on every report.
  • Measured133 of 133 experiment tests at the runtime rejection-diagnostics revision, in the pinned network-disabled harness, reproduced by internal automated testing on a separate build on October 10, 2026 (Pacific).
  • BuildingPreprocessing identity. Not recorded yet.
  • AheadHardware attestation. Runtime identity is a worker self-report.
Roadmap
Release identity for cpu-2: model, configuration, release and receipt digests; preprocessing not recorded.
Open questions

What is still open.

Naming preprocessing

How to identify tokenizers, scaling and feature code by digest.

More than one runtime

Other runtimes and accelerators. No adapters are built.

Model provenance

Where a model and its training inputs came from, beyond its digest.

A compromised host

Its self-report can say anything. Outside the experiment.

Related research

How Vraelis Contour worksSuppliers and integrators
Equipment and workstations in an engineering laboratory.Security evidenceNetwork cables connected to equipment.Machine trustAn engineer inspecting or repairing a circuit board.Adversarial threats

Study these problems with us.

For researchers and academic teams.

Research collaborationContour documentation