Intake
What arrived, who it came from, and what this run is capable of assessing before a single measurement is taken.
Submissions per contributor
Attribution came from contributors_csv. Where it is unavailable every sample resolves to unknown — a real string, not a contributor — and source-level assessment is refused rather than computed over it.
Capability negotiation
Capability is a function of two variables: how much of the model we can see, and what reference material exists to compare against. The cell decides which engines may run and what confidence any of them can reach. It is declared at intake, not inferred.
| R0 nothing | R1 digest | R2 baseline | R3 clean data | |
|---|---|---|---|---|
| L0 | · | · | · | · |
| L1 | · | · | · | · |
| L2 | · | · | · | · |
| L3 | · | THIS RUN | · | · |
At L0/R0 — artifact bytes, no reference — almost nothing works at any access level. Stating that is stronger than pretending otherwise.
Preprocess
Hash every image for exact identity, perceptually hash it for near identity, embed it for semantic geometry — then collapse what is not independent.
The denominator of every rate in this report
Two hundred duplicates of one image are one piece of evidence, not two hundred. Treating them as independent trials produces credible intervals an order of magnitude too narrow, and it is the single easiest way to turn one careless upload into a fabricated threat signal. Every rate downstream is computed over evidence units.
dHash union-find at Hamming <= 5, banded candidate generation
Engines
Five detectors, each declaring the axis of physical evidence it reads and the capability it needs. None of them decides anything.
Findings emitted per engine
Count is not importance. An engine that emits forty findings has not found forty attacks — it has taken forty measurements, and what they mean is decided two stages from here.
What each engine is valid for
| Engine | Axis | Needs | Ran | Findings | Ceiling | Valid poison ratio | Failure mode above range |
|---|---|---|---|---|---|---|---|
| model_safety_gate | deterministic | L0/R0 | ran | 6 | not_declared | robust - no minority assumption | robust - static structure, no minority assumption. It is bounded differently- by the allowlist, which reports what it does not recognise rather than what it knows to be bad |
| exact_duplicate | identity | L0/R0 | ran | 3 | not_declared | robust - no minority assumption | robust - deterministic |
| near_duplicate | pixel | L0/R0 | ran | 11 | not_declared | robust - no minority assumption | robust - cluster size is measured, not compared to a corpus baseline |
| duplicate_flooding | metadata | L0/R0 | ran | 2 | not_declared | robust - no minority assumption | robust - size-based, does not assume the anomaly is a minority |
| label_consistency | semantic | L0/R0 | ran | 58 | not_declared | < 30% | neighbour vote inverts; the flipped label becomes the majority |
| out_of_distribution | semantic | L0/R0 | ran | 44 | not_declared | < 10% | silent false negative - the outlier population becomes the reference |
| contributor_confusion | semantic | L0/R0 | ran | 5 | not_declared | < 30% | neighbour vote inverts once a class is roughly 30% flipped corpus-wide - the flipped label becomes the neighbourhood's and the direction disappears; a contributor who dominates a class also leaves the leave-one-out baseline too little of it to compare against |
| trigger_texture | frequency | L0/R0 | ran | 14 | not_declared | robust - no minority assumption | robust to poison ratio - scored against the corpus median, which a stamp on a minority of objects cannot move; blind to smooth triggers (blend, warp, colour shift) at any ratio |
| spectral_signature | semantic | L0/R0 | ran | 44 | not_declared | < 33% | the poisoned sub-population becomes large enough to move the class mean and share the top direction with clean variation; separation fades rather than failing loudly |
| semantic_witness | witness | L0/R0 | ran | 587 | insufficient_evidence | robust - no minority assumption | not characterised |
| inference_provenance | provenance | L0/R0 | ran | 16 | not_declared | robust - no minority assumption | robust - cryptographic, no minority assumption. It is bounded by key custody instead- a node whose signing key is compromised seals records this engine accepts |
| distribution_shift | semantic | L0/R1 | ran | 9 | not_declared | robust - no minority assumption | bounded by the reference, not by a poison ratio - a reference that already holds the manipulation absorbs it, and the shift test then reports its REMOVAL as the change |
| weight_integrity | deterministic | L0/R0 | ran | 1 | not_declared | robust - no minority assumption | not characterised |
| model_fingerprint | model_behaviour | L1/R0 | ran | 1 | not_declared | robust - no minority assumption | not characterised |
| backdoor_scan | model_behaviour | L3/R0 | ran | 1 | not_declared | robust - no minority assumption | robust to poison ratio - the model is probed, not the corpus; bounded instead by the search space (small local patches) and by how strongly the backdoor was learned |
| poison_localization | model_behaviour | L2/R0 | ran | 16 | not_declared | < 50% | once poison is most of the target class its mean moves toward the trigger and the affinity score stops separating the two |
| model_spectral | model_behaviour | L2/R0 | ran | 45 | not_declared | < 33% | the same as D11 - a poison that is a large share of the class moves the mean and shares the top direction; separation fades rather than failing loudly. It also inherits the model's own blind spots, and a class the model learned badly shows a signature without any poison |
| behaviour_probe | model_behaviour | L1/R0 | ran | 11 | not_declared | robust - no minority assumption | not characterised |
| inference_reexecution | model_behaviour | L0/R0 | ran | 7 | not_declared | robust - no minority assumption | not characterised |
| pipeline_differential | model_behaviour | L1/R0 | ran | 1 | not_declared | robust - no minority assumption | not characterised |
Outlier-based engines assume the anomaly is a minority and fail silently above their range: at a high enough poison ratio the poison becomes the norm and the system reports fewer findings, not more. Publishing the bound is a coverage dimension, and it is why the size-based flood detector exists alongside them.
Vector space
The corpus as the engines see it. Orbit it, pick a point, and the neighbours that come back are the ones the label engine actually voted over.
Selected point
Click any point to inspect it. Nothing is selected yet.
Nearest neighbours
Exact cosine neighbours over the full embedding, not an approximation — the same ranking the label engine voted over. Select a point to see them.
Evidence
The measurements themselves. Every finding shows its numbers, its pictures, and what it cannot tell you.
duplicate_flooding
highunit_e32 of 32 shown
32 near-identical images, 94% of them from unit_e, all carrying class 'truck'. A single source repeating one scene at this multiplicity shifts what the model learns about it without mislabelling anything.
All findings
| Severity | Confidence | Finding | Axes | Contributor | Score | Disposition |
|---|
Traceback
Every verdict, walked back to the bytes it came from. Pick a source and follow the chain — samples, the clusters they collapse into, the findings those raised, the axes that agreed, and the rule that produced the disposition.
Corroborate
An anomaly is never, by itself, an attack. This is where measurements become a judgement — and where two engines reading the same signal stop counting as two.
Measured evidence independence
Rank correlation of each engine pair over dense per-sample scores — every sample, not only the flagged ones. Correlating findings alone would be circular: two engines that never fire on the same asset look independent precisely because neither fired.
The corroboration rule
| 0 axes | no finding |
| 1 axis | data quality → review |
| broad, uncorrelated | drift → recalibrate, never quarantine |
| ≥ 3 axes | attack → quarantine |
The rule governs escalation, not visibility. Nothing is suppressed — a single-axis anomaly still reaches the analyst queue. What corroboration controls is what gets the word attack attached, and what interrupts someone at 2am.
124 pair(s) had too few shared samples to measure and were treated as independent — the permissive direction, reported rather than hidden.
Sources
Sample-level evidence aggregated into a source-level assessment — in evidence units, against baselines that exclude the contributor being tested.
unit_b
highquarantine61 samples → 60 evidence unitsunit_b: 4 abnormal axis/axes across 60 independent evidence units (61 samples). trigger_texture 14/60 units (23.3% vs 0.0% baseline, 999.0x, no null); witness_marking 14/60 units (23.3% vs 0.5% baseline, 45.5x, q=0.0000); poison_localized 13/60 units (21.7% vs 1.5% baseline, 14.1x, q=0.0000); contributor_confusion 14/30 off-diagonal observations in one class pair (46.7% vs 10.5% baseline, 4.4x, q=0.0013) Carried forward from the findings list: 131 finding(s) name unit_b directly (model_spectral_signature, out_of_distribution, poison_localized, spectral_signature, swapped_label, trigger_behaviour, trigger_texture, witness_label_disagreement, witness_marking, witness_scene_mismatch), at severity high. Note that this did not come from a rate test - it cannot, because the evidence collapses to 60 independent unit(s) - it comes from the absolute size of what was submitted.
unit_a
highquarantine64 samples → 60 evidence unitsunit_a: 2 abnormal axis/axes across 60 independent evidence units (64 samples). contributor_confusion 10/11 off-diagonal observations in one class pair (90.9% vs 0.0% baseline, 999.0x, q=0.0000); labelling_inconsistency 1/60 units (1.7% vs 0.0% baseline, 999.0x, no null) Carried forward from the findings list: 67 finding(s) name unit_a directly (model_spectral_signature, out_of_distribution, spectral_signature, swapped_label, witness_label_disagreement, witness_scene_mismatch), at severity high. Note that this did not come from a rate test - it cannot, because the evidence collapses to 60 independent unit(s) - it comes from the absolute size of what was submitted.
unit_f
highquarantine15 samples → 15 evidence unitsunit_f: 2 abnormal axis/axes across 15 independent evidence units (15 samples). contributor_confusion 4/14 off-diagonal observations in one class pair (28.6% vs 0.0% baseline, 999.0x, q=0.0017); model_spectral_signature 15/15 units (100.0% vs 12.1% baseline, 8.3x, q=0.0000); out_of_distribution 15/15 units (100.0% vs 12.1% baseline, 8.3x, q=0.0000); swapped_label 12/15 units (80.0% vs 18.8% baseline, 4.3x, q=0.0000) Carried forward from the findings list: 77 finding(s) name unit_f directly (model_spectral_signature, out_of_distribution, poison_localized, spectral_signature, swapped_label, witness_label_disagreement, witness_scene_mismatch), at severity high. Note that this did not come from a rate test - it cannot, because the evidence collapses to 15 independent unit(s) - it comes from the absolute size of what was submitted.
unit_c
highquarantine71 samples → 60 evidence unitsunit_c: 1 abnormal axis/axes across 60 independent evidence units (71 samples). contributor_confusion 7/9 off-diagonal observations in one class pair (77.8% vs 25.6% baseline, 3.0x, q=0.0100) Carried forward from the findings list: 30 finding(s) name unit_c directly (out_of_distribution, swapped_label, witness_label_disagreement, witness_scene_mismatch), at severity high. Note that this did not come from a rate test - it cannot, because the evidence collapses to 60 independent unit(s) - it comes from the absolute size of what was submitted.
unit_d
highquarantine61 samples → 60 evidence unitsunit_d: 1 abnormal axis/axes across 60 independent evidence units (61 samples). contributor_confusion 12/23 off-diagonal observations in one class pair (52.2% vs 3.1% baseline, 16.7x, q=0.0000) Carried forward from the findings list: 89 finding(s) name unit_d directly (model_spectral_signature, out_of_distribution, spectral_signature, swapped_label, witness_label_disagreement, witness_scene_mismatch), at severity high. Note that this did not come from a rate test - it cannot, because the evidence collapses to 60 independent unit(s) - it comes from the absolute size of what was submitted.
unit_e
highreview30 samples → 1 evidence unitsunit_e contributed 30 samples collapsing to 1 independent evidence unit(s), below the 5 this policy requires before a rate is meaningful. No assessment is made. Carried forward from the findings list: 1 finding(s) name unit_e directly (duplicate_flooding), at severity high. Note that this did not come from a rate test - it cannot, because the evidence collapses to 1 independent unit(s) - it comes from the absolute size of what was submitted.
Coverage
What this run measured about itself, what it could not see, and why its absence is not a clean result.
Every assessment this system can make, and whether it was made here
| assessment | engine | state | why |
|---|---|---|---|
| static pickle opcode analysis against an import allowlist | model_safety_gate | covered | 6 findings from this engine |
| archive structure: traversal, symlinks, decompression ratio | model_safety_gate | covered | 6 findings from this engine |
| ONNX operator domains and external-data references | model_safety_gate | covered | 6 findings from this engine |
| safetensors header structure: dtypes, shapes, spans | model_safety_gate | covered | 6 findings from this engine |
| the access tier the artifact earns for the whole assessment | model_safety_gate | covered | 6 findings from this engine |
| byte-identical duplicate detection over SHA-256 | exact_duplicate | covered | 3 findings from this engine |
| near-duplicate clustering over perceptual hash and embedding | near_duplicate | covered | 11 findings from this engine |
| train/validation leakage detection | near_duplicate | covered | 11 findings from this engine |
| intra-cluster labelling disagreement | near_duplicate | covered | 11 findings from this engine |
| source-concentrated near-duplicate flooding | duplicate_flooding | covered | 2 findings from this engine |
| per-contributor duplication lift against the corpus | duplicate_flooding | covered | 2 findings from this engine |
| embedding neighbour-vote label disagreement | label_consistency | covered | 58 findings from this engine |
| per-class embedding reliability measurement | label_consistency | covered | 58 findings from this engine |
| kNN-distance outlier scoring (local) | out_of_distribution | covered | 44 findings from this engine |
| Mahalanobis outlier scoring (global) | out_of_distribution | covered | 44 findings from this engine |
| per-contributor directional label confusion against a leave-one-out baseline | contributor_confusion | covered | 5 findings from this engine |
| local texture anomaly scan for stamped triggers | trigger_texture | covered | 14 findings from this engine |
| trigger-pattern scan of training data | spectral_signature | covered | 44 findings from this engine |
| per-class spectral signature of crop embeddings | spectral_signature | covered | 44 findings from this engine |
| semantic witness: an independent vision-language model's label, marking and scene answers | semantic_witness | covered | 587 findings from this engine |
| inference-record integrity (digest recomputation) | inference_provenance | covered | 16 findings from this engine |
| inference-record signatures against the trust store | inference_provenance | covered | 16 findings from this engine |
| inference log continuity: deletion, reordering, splicing | inference_provenance | covered | 16 findings from this engine |
| inference-record replay | inference_provenance | covered | 16 findings from this engine |
| model identity against the authorised deployment | inference_provenance | covered | 16 findings from this engine |
| pre/post-processing configuration against the deployment | inference_provenance | covered | 16 findings from this engine |
| input binding: substitution versus benign re-encoding | inference_provenance | covered | 16 findings from this engine |
| distribution drift against a reference profile | distribution_shift | covered | 9 findings from this engine |
| calibrated shift test (permutation p-value) | distribution_shift | covered | 9 findings from this engine |
| shift localisation by contributor and by class | distribution_shift | covered | 9 findings from this engine |
| physical characterisation: lighting, blur, noise, compression, haze | distribution_shift | covered | 9 findings from this engine |
| drift versus manipulation signatures | distribution_shift | covered | 9 findings from this engine |
| per-image nonconformity at a controlled false discovery rate | distribution_shift | covered | 9 findings from this engine |
| weight and graph integrity | weight_integrity | covered | 1 finding from this engine |
| behavioural fingerprinting | model_fingerprint | covered | 1 finding from this engine |
| backdoor trigger inversion | backdoor_scan | covered | 1 finding from this engine |
| localisation of poisoned training samples through model features | poison_localization | covered | 16 findings from this engine |
| per-class spectral signature in the submitted model's own features | model_spectral | covered | 45 findings from this engine |
| transplant probing of candidate triggers through the full pipeline | behaviour_probe | covered | 11 findings from this engine |
| re-execution of sealed inferences (signed but wrong) | inference_reexecution | covered | 7 findings from this engine |
| twin-pipeline differential of the deployed configuration | pipeline_differential | covered | 1 finding from this engine |
Read this as the list of questions the run was asked, not the list it answered. Three of the four states are ways of being absent and they are not equivalent: a submission that could not support a check, a run not entitled to make one, and a check nobody has written are different liabilities, and a single grey "N/A" would let the weakest of them borrow the credibility of the strongest. Coverage is recorded against the engine that owns the assessment; where an engine ran but hit a limit inside itself, that limit is on the findings it produced.
Per-class embedding reliability
How often a crop’s own label matches its nearest genuine neighbour, measured on every crop in this corpus. A label finding on a class the embedding cannot separate is weaker evidence than the same score on one it can, and policy holds it one severity step down.
How the two OOD statistics disagreed
| samples_scored | 302 |
| knn_enabled | True |
| mahalanobis_enabled | True |
| knn_flagged | 42 |
| mahalanobis_flagged | 22 |
| both | 20 |
| mahalanobis_only | 2 |
| knn_only | 22 |
| projection | PCA to 60 components (from 64) for an estimable covariance |
| components | 60 |
A sample flagged by Mahalanobis while kNN stays silent is the documented signature of an inserted group large enough to become its own neighbourhood — the exact case local density scoring misses without any error.
Where the outliers sit
Both panels share one projection and one scale, so the only difference between them is which samples each statistic lights up. Running both is the point: they fail in opposite directions, and the disagreement is the signal.
Coverage statement
Template-generated from values this run computed. Never free text, never from a language model: in an air-gapped assurance system a hallucinated explanation is worse than no explanation.
- This run assessed a dataset, 6 model file(s), 73 inference record line(s), at access level L3 and reference level R1.
- Embeddings came from the stub-pixelstats backbone, which is pixel statistics rather than a learned representation. Semantic findings in this report describe pixel-statistical neighbourhoods and must not be reported as semantic results; re-run with a DINOv2 backbone before quoting any number here.
- Confidence is measured where the attack harness (tools/harness.py) has measured it: for a finding type at a corroboration level with at least the harness's min_findings findings, confidence is the share of such findings that named a planted defect across the harness's scenarios, and the finding says "calibrated" and names the measurement. Everywhere else it is a provisional heuristic over corroboration and must not be read as "N% of findings at this score were truly attacks". Deterministic findings (exact duplicate, hash identity, signatures) are exempt: their confidence is 1.0 by construction.
- 124 engine pair(s) had too few shared assets to measure rank correlation and were treated as independent. That is the permissive direction: if they are in fact correlated, some findings here are corroborated by one axis counted twice.
- duplicate_flooding and exact_duplicate correlate at rho=0.7019 across 302 samples on this corpus and were collapsed into a single evidence axis before corroboration was counted. Any finding resting on both therefore holds ONE axis, not two, and is dispositioned accordingly - a weaker call than treating them as separate, and the correct one: counting a measurement twice because two engines computed it is how a corroboration rule becomes decorative.
- duplicate_flooding and near_duplicate correlate at rho=0.9891 across 302 samples on this corpus and were collapsed into a single evidence axis before corroboration was counted. Any finding resting on both therefore holds ONE axis, not two, and is dispositioned accordingly - a weaker call than treating them as separate, and the correct one: counting a measurement twice because two engines computed it is how a corroboration rule becomes decorative.
- 3 high-severity finding(s) stopped at 'review' rather than 'quarantine' because the axes supporting them collapsed to fewer than the 2 this policy requires. Escalating them would need corroboration from an axis this run did not have - frequency, model behaviour, or provenance - not a lower threshold.
- 2 sample(s) were flagged by the global Mahalanobis statistic while the local kNN statistic was silent. That is the documented signature of an inserted group large enough to become its own neighbourhood, and it is the case kNN-only OOD scoring misses without any error.
- The model safety gate read 6 model artifact(s) statically - no file was deserialised - and the assessment earned access tier L0: backdoored.safetensors clean (L3); custom_layer.pt unrecognized (L1); evil_pickle.pt dangerous (L0); external_escape.onnx dangerous (L0); pyop.onnx dangerous (L0); zip_bomb.pt corruption (L0). The run declared L3, so it proceeded at L3.
- The tier was set by the model under assessment (backdoored.safetensors); custom_layer.pt, evil_pickle.pt, external_escape.onnx, pyop.onnx, zip_bomb.pt were refused and never opened, and cap only themselves - a refused file bundled beside a model cannot switch off the model's own checks.
- The runtime can do L3 with backdoored.safetensors: white box - queries, features and gradients. Model-behaviour engines needing more than the effective tier are listed as not run with that reason: refused by the tier, not unwritten.
- ONNX is checked as a graph: operator domains, external-data references and declared shapes. What the weights compute is not assessed here.
- safetensors is data only - 20 tensor(s) and a header were checked; it carries no code path. Its declared architecture (pramana-tinydet-v1) must still be one the runtime defines before anything executes it.
- inference_provenance verified 72 of 73 record line(s) across 3 session(s): 69 signature(s) verified, 1 invalid, 1 from untrusted keys, 1 unsigned and 0 unverifiable.
- A valid signature proves who sealed a record, not that the output is what the model would have said. inference_reexecution re-ran 68 of 73 record(s) on the authorised model the assessor holds: 61 reproduced, 7 did not. Not re-executable: 1 naming an unauthorised model, 1 with no stored input, 0 whose deployment has no model file held. Truncation of a session's most recent records is undetectable from the log alone.
- A reference dataset (ds_37b37e2da4f4) was declared, so the run proceeded at reference level R1: a declared operational reference, not a certified clean corpus. Every finding in this report carries R1 for that reason.
- distribution_shift compared 302 image(s) with 240 in reference ds_37b37e2da4f4: global permutation p = 1e-05, read as operational drift - 5 of 6 contributor(s) shifted (broad); 3 of 4 class(es) shifted (not class-selective); descriptors reproduce 100% of the separation (physically explained). The p-value is exact under exchangeability; the reading is a written rule in policy.yaml (`shift:`), not a trained classifier.
- contributor_confusion did not test 1 contributor(s) (unit_e): each has fewer than the 10 independent evidence units a directional test requires. Untested is not clean.
- backdoor_scan synthesised a 8x8 trigger for 12 ordered class pair(s); median attack success 0%, surfaced: truck->tank. The search covers small local patches only: blended, warping and semantic triggers are outside it, so a clean scan does not rule them out.
- The investigation scheduler formed 10 hypothesis(es) from the data evidence and ordered 26 model experiment(s) by prior x power / cost; 26 ran within a budget of 60 (spent 26.8). Priors are a documented heuristic over the number of independent data axes behind each hypothesis, not probabilities.
- H1 (objects labelled drone carry an injected trigger that the model learned; prior 0.3): not reproduced by 3 experiment(s); a statement about these experiments, not an acquittal.
- H2 (objects labelled jet carry an injected trigger that the model learned; prior 0.55): not reproduced by 3 experiment(s); a statement about these experiments, not an acquittal.
- H3 (objects labelled tank carry an injected trigger that the model learned; prior 0.9): reproduced in the model by E01, E03, E04, E05, E06, E07 and 6 more.
- H4 (objects labelled truck carry an injected trigger that the model learned; prior 0.8): not reproduced by 3 experiment(s); a statement about these experiments, not an acquittal.
- H5 (unit_a's tank->jet label flips are poisoning a tank->jet backdoor; prior 0.3): not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal.
- H6 (unit_b's truck->tank label flips are poisoning a truck->tank backdoor; prior 0.3): reproduced in the model by E15.
- H7 (unit_c's drone->jet label flips are poisoning a drone->jet backdoor; prior 0.3): not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal.
- H8 (unit_d's tank->truck label flips are poisoning a tank->truck backdoor; prior 0.3): not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal.
- H9 (unit_f's truck->jet label flips are poisoning a truck->jet backdoor; prior 0.3): not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal.
- Declared unsupported: clean-label poisoning (feature collision, gradient matching). The label is correct and no trigger is stamped, so neither the label engines nor the texture axis have anything to see; only model-side analysis could.
- Declared unsupported: smooth or invisible triggers (blended, warping such as WaNet, colour-shift such as SIG, frequency-domain). They concentrate no high-frequency energy, so the texture axis is blind; the spectral axis may still show a sub-population, which alone is held at review.
- Declared unsupported: model backdoors whose trigger is not a small local patch (blended, warping, colour-shift, semantic or physical-object triggers). Trigger inversion searches small local patches only; a clean scan says nothing about triggers outside that search space.
- Declared unsupported: backdoors in a model supplied only as a black box (ONNX) with no trace in the data. Inversion needs gradients (L3); a black box earns fingerprinting, transplant probes of data-derived candidates, re-execution and the pipeline differential, not inversion.
- Declared unsupported: behaviour of a model supplied only as a PyTorch .pt / .pth or TorchScript file. Those formats are pickles - programs - and are gated statically, never executed; their structure is scanned (malicious imports, escapes, bombs) but no behaviour is observed until the supplier exports ONNX (for Ultralytics, `yolo export model=best.pt format=onnx`).
- Declared unsupported: behaviour of an ONNX detector outside the recognised export families. The zoo interface and the yolov8 / yolov5 layouts are decoded; any other output layout is refused with the shape seen rather than decoded wrongly.
- Declared unsupported: signed-but-wrong inference outputs when the assessor holds no copy of the authorised model. Every provenance check passes; re-execution needs the model file registered in the trust store.
- Declared unsupported: a substitute model crafted to match the public challenge set. The fingerprint's challenge images are published and seeded; a model tuned to answer them as the registered one does is not caught by the fingerprint, only by the weight hash.
- Declared unsupported: truncation of the most recent inference records of a session. Nothing after the last record vouches for its existence without a separately published session head.
- Declared unsupported: a poisoned pretrained backbone. Embeddings are computed with the vendored backbone, which is trusted by assumption and pinned by hash, not assessed.
- Declared unsupported: poison spread thinly across many contributors. Every per-source test is powered by one source's evidence units; collusion below that power is invisible at source level.
- Declared unsupported: an adaptive attacker who reads this policy. Every threshold is published by design; an attacker who stays below all of them is not detected by a threshold.
- Declared unsupported: a contaminated drift reference. The reference is declared, not certified; contamination already in it becomes the baseline.
- Declared unsupported: physical adversarial patches, evasion, model extraction, sponge or denial-of-service attacks on the deployed model. Out of this build's scope - they are inference-time attacks on a deployed model, not integrity failures of the data, the model artifact or the records.
- Declared unsupported: text inside an image steering the semantic witness (prompt injection). A vision-language model reads text; a crop with words painted on it can change its answer, so the witness is one corroborating axis and never decides alone.
- Declared unsupported: adversarial patches against the semantic witness itself. The witness is a neural network and can be fooled like any other; its answers are measured for reliability per class, not trusted.
- Declared unsupported: detectors outside the zoo architecture. Weights are executed only in architectures this system defines (pramana-tinydet-v1 today); another architecture is assessed as ONNX (black box) or not at all.
- Not covered by any engine in this run: . Their absence from this report is a scope statement, not a clean result.
- 1 in-scope claim(s) are unresolved because an assessment they require did not run: C5.2 (ledger_intact). Unresolved is not supported, and the decision reflects it.
Safety gate
A contributed model file is a program, and opening one to assess it is itself a way into the enclave. This gate parses statically; it never deserialises, on any branch.
Artifacts
| file | format | verdict | tier | findings |
|---|---|---|---|---|
| backdoored.safetensors | safetensors | infoPASS | L3 | 0 |
| custom_layer.pt | pytorch_zip | highREFUSE | L1 | 1 |
| evil_pickle.pt | pytorch_zip | highREFUSE | L0 | 1 |
| external_escape.onnx | onnx | highREFUSE | L0 | 1 |
| pyop.onnx | onnx | highREFUSE | L0 | 2 |
| zip_bomb.pt | pytorch_zip | highREFUSE | L0 | 1 |
Nothing here was deserialised. Every verdict comes from the serialized structure alone - opcodes, the ZIP directory, protobuf fields.
Tier this artifact earned
| R0 | R1 | R2 | R3 | |
|---|---|---|---|---|
| L0 | · | EARNED | · | · |
| L1 | · | · | · | · |
| L2 | · | · | · | · |
| L3 | · | THIS RUN | · | · |
Declared L3, earned L0, so the run proceeds at L3. The cap is applied before any other engine is asked whether it can run.
Refusals — the offending detail, verbatim
backdoored.safetensors
highweight_mismatchhighbehaviour_mismatchhighbackdoor_triggerhighpipeline_divergencebackdoored.safetensors hashes to 697d07927a7d20cd..., but deployment 'tinydet-v1' (declared deployment 'tinydet-v1') authorises 8a693d9f7a6da1f6.... Compared tensor by tensor with the authorised weights: 20 tensor(s) differ, covering 100% of the parameters; largest relative change 1.352 in region.3.weight.
backdoored.safetensors does not behave as deployment 'tinydet-v1': re-running the authorised model on the same 24 public challenge images, the two disagree on the class of 12 and move the box by more than 0.02 of the image on 24 (largest 0.810). Its fingerprint is 6faec123145f37d5....
A 8x8 patch, synthesised in 80 steps and pasted at random positions, turns 100% of 46 held-out truck crops into tank, against 0% for the reference (median of other pairs; 12 pair(s) tested): this pair has a shortcut a small local pattern can trigger, which is what a planted backdoor leaves.
The same model behind the declared pipeline and behind deployment 'tinydet-v1''s pipeline answers differently on 19% of 96 images (jet->drone x18). Bisected key by key: postprocess.class_map = {"jet": "drone"} alone changes 19%. The largest single cause is postprocess.class_map.
custom_layer.pt
mediumunrecognized_importGLOBAL at offset 2 in archive/data.pkl imports `acme_layers.blocks.GatedBlock`, which is not on the 18-entry allowlist a torch checkpoint needs.
evil_pickle.pt
highmalicious_model_fileGLOBAL at offset 2 in archive/data.pkl imports `posix.system`, which is not on the 18-entry allowlist a torch checkpoint needs. `posix.system` is a known code-execution gadget: REDUCE on it calls it with attacker-chosen arguments the moment the file is deserialised.
external_escape.onnx
highexternal_data_escapeinitializer `w0` loads its weights from external data at `../outside_the_model_directory.bin`, which escapes the model directory with a `..` segment. The loader reads that path with no checker in between, so it is a read primitive pointed wherever the artifact author chose.
pyop.onnx
highmalicious_model_filemediumunrecognized_importnode `pyop_node` (index 0) is operator `com.microsoft.PyOp`, whose domain `com.microsoft` is outside the permitted set (<default>, ai.onnx, ai.onnx.ml, ai.onnx.preview.training, ai.onnx.training). `com.microsoft.PyOp` names a Python module and class to import and call during inference: it is arbitrary code execution when the model RUNS, and no weight analysis, trigger inversion or behavioural fingerprint will ever find it, because the backdoor is in the architecture rather than the weights.
pyop.onnx imports operator set domain `com.microsoft`, which is outside the permitted set. Every operator it supplies is implemented by code this gate cannot see.
zip_bomb.pt
mediumstructural_corruptionzip_bomb.pt expands 1028x (20391 bytes to 20971522), above the 100x cap: refused on the directory without decompressing any member.
Checks performed
| ZIP structure | no `..` segments, no symlink entries, member cap |
| Decompression ratio | read from the directory - a bomb is never expanded to measure it |
| Import allowlist | every GLOBAL / STACK_GLOBAL against the entries a checkpoint needs |
| Extension opcodes | EXT1 / EXT2 / EXT4 refused - they name nothing checkable |
| Opcode count and depth | capped; exhausting our own parser is a denial of service |
| Storage sizes | declared element counts against the bytes actually present |
| ONNX operator domains | ai.onnx, ai.onnx.ml and an explicit permitted set |
| ONNX external data | absolute, `..`-escaping, symlinked or multiply-linked refused |
| Graph well-formedness | dangling inputs, cycles, declared shapes |
Engines this tier gates
The run proceeds at L3: the lower of what the file earned, what the run declared, and what the runtime can do with the format (runtime L3). Greyed engines were refused by the tier and are listed as not run with that reason; a check nobody built would carry UNWRITTEN instead, and the two are never blended.
Memory
Every engine is stateless, so on its own every run is a scan. Memory is the only thing that makes assessment fifty better than assessment one.
Readiness
How much of this submission is usable, what that judgement rests on, and what it cannot see.
0 of 302 images (0.0%) carry no finding. 350 were named by at least one engine and need review before use.
This number is not calibrated and does not mean "0% safe". It is an arithmetic summary of what was flagged, scaled by how much of the system actually ran. Read the panel below before quoting it.
How the number was produced
| severity | images | of corpus | weight | points |
|---|---|---|---|---|
| high | 63 | 20.861% | ×8.0 | −166.89 |
| info | 162 | 53.642% | ×0.0 | −0.0 |
| low | 306 | 101.325% | ×0.5 | −50.66 |
| medium | 190 | 62.914% | ×2.0 | −125.83 |
Coverage is 100%: 41 of 41 assessments were actually attempted. An engine that did not run is not a pass, so it pulls the score down rather than being silently left out of it. Weights are in policy.yaml, not in this page.
What is wrong, and what each costs to fix
| defect | images | of corpus | findings | what it means you do |
|---|---|---|---|---|
| witness_scene_mismatch | 302 | 100.0% | 302 | confirm the image belongs in this corpus |
| witness_label_disagreement | 270 | 89.4% | 270 | re-annotate: an independent model disagrees with the label |
| swapped_label | 58 | 19.21% | 58 | re-annotate the box; the neighbour vote disagrees |
| split_leakage | 52 | 17.22% | 6 | INVALIDATES the split - retrain metrics are inflated |
| contributor_confusion | 52 | 17.22% | 5 | audit that source's labelling of the class pair |
| model_spectral_signature | 45 | 14.9% | 45 | inspect what the model learned apart from the class; check the label |
| spectral_signature | 44 | 14.57% | 44 | inspect the class's outlying sub-population and its source |
| out_of_distribution | 44 | 14.57% | 44 | confirm it belongs in this corpus at all |
| duplicate_flooding | 33 | 10.93% | 1 | investigate the source before accepting the batch |
| visual_duplicate | 17 | 5.63% | 4 | collapse the cluster to one representative |
| poison_localized | 16 | 5.3% | 16 | exclude the sample from training; audit its source |
| witness_marking | 15 | 4.97% | 15 | inspect the object for a stamp or patch |
| trigger_texture | 14 | 4.64% | 14 | inspect the object for a stamped pattern; check its label |
| exact_duplicate | 13 | 4.3% | 3 | delete the redundant copies; keep one |
| trigger_behaviour | 11 | 3.64% | 11 | treat the patch as a trigger; remove its carriers |
| output_mismatch | 7 | 2.32% | 7 | exclude the record; the model did not produce it |
| contributor_shift | 5 | 1.66% | 5 | compare this source's recent imagery with its earlier submissions |
| labelling_inconsistency | 4 | 1.32% | 1 | re-annotate: near-identical images disagree |
| class_shift | 3 | 0.99% | 3 | inspect the most unusual objects of this class |
| malicious_model_file | 2 | 0.66% | 2 | do not load the artifact; quarantine it |
| chain_break | 2 | 0.66% | 2 | exclude the record; find what was spliced in |
| unrecognized_import | 2 | 0.66% | 2 | review the finding and decide |
| record_altered | 1 | 0.33% | 1 | exclude the record; the output was edited after sealing |
| input_substituted | 1 | 0.33% | 1 | exclude the record; the stored input is not the one used |
| record_replayed | 1 | 0.33% | 1 | exclude the duplicate; check what consumed it twice |
| untrusted_signer | 1 | 0.33% | 1 | exclude the record; identify the key that sealed it |
| chain_fork | 1 | 0.33% | 1 | exclude both; the session history is ambiguous |
| record_deleted | 1 | 0.33% | 1 | recover the missing records from the node |
| model_substitution | 1 | 0.33% | 1 | exclude the output; confirm which model ran |
| weight_mismatch | 1 | 0.33% | 1 | do not deploy; obtain the registered artifact |
| signature_invalid | 1 | 0.33% | 1 | exclude the record; re-derive it from the node |
| behaviour_mismatch | 1 | 0.33% | 1 | do not deploy; the model is not the registered one |
| external_data_escape | 1 | 0.33% | 1 | review the finding and decide |
| backdoor_trigger | 1 | 0.33% | 1 | retrain without the localised samples; re-scan the pair |
| pipeline_divergence | 1 | 0.33% | 1 | restore the authorised pre/post-processing |
| mass_submission_anomaly | 1 | 0.33% | 1 | investigate the source before accepting |
| record_unsigned | 1 | 0.33% | 1 | require the node to sign, or re-seal from source |
| record_reordered | 1 | 0.33% | 1 | restore log order before replaying the session |
| input_missing | 1 | 0.33% | 1 | recover the evidence copy of the input |
| record_unparseable | 1 | 0.33% | 1 | recover the line from the node's own log |
| config_mismatch | 1 | 0.33% | 1 | confirm the configuration change was sanctioned |
| structural_corruption | 1 | 0.33% | 1 | review the finding and decide |
| input_transcoded | 1 | 0.33% | 1 | keep the original bytes next time; no action on the output |
| distribution_shift | 1 | 0.33% | 1 | read the shift reading; recalibrate on drift, investigate on manipulation |
Image counts across rows overlap - one image can carry more than one defect - so they do not sum to the flagged total. The remedies differ by class and that is the point: a duplicate is deleted, a swapped label is re-annotated, and leakage invalidates a whole split rather than an image.
Where the findings fall
| split | findings |
|---|---|
| (cluster-level) | 63 |
| test | 68 |
| train | 569 |
| valid | 182 |
Cluster-level findings name a group rather than a single split, so they are listed separately rather than assigned to one.
Recommended disposition
| quarantine | 417 |
| recalibrate | 9 |
| review | 456 |
Disposition is an instruction from the correlation layer, not a severity restated. Everything here is advisory: nothing is deleted or quarantined by this tool.
What this number does not know
- Not calibrated as a probability. 812 of 849 statistical findings carry a confidence the attack harness measured against planted truth; the rest are provisional heuristics. The score itself is an arithmetic summary of findings, not a probability that the data is safe.
- Says nothing about what was MISSED. Recall is unmeasurable without planted ground truth, so a high score from an engine that found nothing is indistinguishable from a high score that was earned.
- Merges severity and confidence, which this system separates everywhere else. It cannot express 'high severity, low confidence' - the state that most needs a human.
- Saturated: the penalty (343.4 points) exceeds the base of 100, so the score floors at zero and stops discriminating. A corpus twice as damaged as this one would also read 0.0 - read the finding counts, not the number.
- Embeddings came from the stub backbone, so every semantic finding behind this number is a pixel statistic, not meaning.
Every item above is generated from what this run actually did. The list shrinks as the gaps close - it is not a fixed disclaimer.
Claims
What this assessment set out to establish, what the evidence supports, and the single action that follows - the most severe claim gate, never an average.
QUARANTINE: set by claim(s) C1.2, C1.3, C1.4, C1.6, C2.1, C2.2, C2.3, C2.4, C3.1, C3.2, C3.3, C3.4. Across 19 in-scope claim(s): 12 contradicted, 2 supported, 1 unresolved, 4 weakened. The action is the most severe claim gate - never an average, never a score.
1 Training-data integrity
| claim | statement | state | gate |
|---|---|---|---|
| C1.1 | No contributor floods the corpus with near-duplicate content. training data whyWeakened by 2 item(s) held for review, recalibration or as inconclusive: f_c390f68e611e, f_2f2168276246. Requirements ✓ source-concentrated near-duplicate flooding ✓ per-contributor duplication lift against the corpus Defeaters duplicate_flooding, mass_submission_anomaly Re-run to reassess duplicate_flooding A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ◐ WEAKENED | review |
| C1.2 | Labels are consistent - no label flipping and no systematic mislabelling by any source. training data whyContradicted by 122 item(s) dispositioned quarantine: f_29a78aa9e864, f_5e6df56dee38, f_90a792c99258, f_f5ff8160dc77, f_7f234817293c, f_1857607e975f.... Requirements ✓ embedding neighbour-vote label disagreement ✓ intra-cluster labelling disagreement ✓ per-contributor directional label confusion against a leave-one-out baseline Defeaters swapped_label, labelling_inconsistency, contributor_confusion, witness_label_disagreement Re-run to reassess contributor_confusion, label_consistency, near_duplicate A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C1.3 | No out-of-distribution population was inserted. training data whyContradicted by 128 item(s) dispositioned quarantine: f_018647ac1b20, f_3d707d920c35, f_53744b6f4e2d, f_5e29439fa918, f_6aac4208c84a, f_71514f00e057.... Requirements ✓ kNN-distance outlier scoring (local) ✓ Mahalanobis outlier scoring (global) Defeaters out_of_distribution, witness_scene_mismatch Re-run to reassess out_of_distribution A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C1.4 | No trigger-bearing samples were injected. training data whyContradicted by 133 item(s) dispositioned quarantine: f_283d2629f235, f_41f1b9ea3ac7, f_5637c47fe79e, f_63717788bf64, f_64446d818eb8, f_6b25ff2789fa.... Requirements ✓ trigger-pattern scan of training data ✓ local texture anomaly scan for stamped triggers Defeaters trigger_texture, spectral_signature, model_spectral_signature, poison_localized, witness_marking Re-run to reassess spectral_signature, trigger_texture A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C1.5 | The evaluation split is independent of the training split, and redundancy does not inflate the corpus. training data whyWeakened by 13 item(s) held for review, recalibration or as inconclusive: f_69f72d21fcc6, f_952439152b11, f_ac371910cac4, f_b4d230054eef, f_c82de62a9cfe, f_d52b4fdf4239.... Requirements ✓ byte-identical duplicate detection over SHA-256 ✓ near-duplicate clustering over perceptual hash and embedding ✓ train/validation leakage detection Defeaters split_leakage, exact_duplicate, visual_duplicate Re-run to reassess exact_duplicate, near_duplicate A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ◐ WEAKENED | review |
| C1.6 | No contributing source is abnormal against its peers. contributing sources whyContradicted by 5 item(s) dispositioned quarantine: contributor:unit_b, contributor:unit_a, contributor:unit_f, contributor:unit_c, contributor:unit_d. Requirements ✓ source-concentrated near-duplicate flooding ✓ per-contributor directional label confusion against a leave-one-out baseline Re-run to reassess contributor_confusion, duplicate_flooding A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
2 Model integrity
| claim | statement | state | gate |
|---|---|---|---|
| C2.1 | The model artifact is safe to open. model whyContradicted by 3 item(s) dispositioned quarantine: f_107364c0af85, f_8c7b2858faf4, f_ee857b9ed772. Requirements ✓ static pickle opcode analysis against an import allowlist ✓ archive structure: traversal, symlinks, decompression ratio ✓ ONNX operator domains and external-data references Defeaters malicious_model_file, external_data_escape, unrecognized_import, structural_corruption Re-run to reassess model_safety_gate A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C2.2 | The model that produced the outputs is the authorised model, not a substitute. model whyContradicted by 1 item(s) dispositioned quarantine: f_487c3bbca861. Requirements ✓ model identity against the authorised deployment Defeaters model_substitution Re-run to reassess inference_provenance A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C2.3 | The model exhibits no backdoor-like behaviour, and no trigger carried by the data moves it. model whyContradicted by 12 item(s) dispositioned quarantine: f_46bf30aaf86d, f_093fbeb1ee51, f_14cf391fb8ed, f_2f0683b6a0ed, f_522af0093f2e, f_6327f01af0b3.... Requirements ✓ backdoor trigger inversion ✓ transplant probing of candidate triggers through the full pipeline Defeaters backdoor_trigger, trigger_behaviour Re-run to reassess backdoor_scan, behaviour_probe A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C2.4 | The model is the authorised model - its weights and its behaviour match the registered deployment. model whyContradicted by 2 item(s) dispositioned quarantine: f_6b52d24ab6d8, f_c3106f512ed2. Requirements ✓ weight and graph integrity ✓ behavioural fingerprinting Defeaters weight_mismatch, behaviour_mismatch Re-run to reassess model_fingerprint, weight_integrity A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C2.5 | The deployed pre- and post-processing behave as the authorised configuration. deployed pipeline whyWeakened by 1 item(s) held for review, recalibration or as inconclusive: f_09351c05426a. Requirements ✓ twin-pipeline differential of the deployed configuration Defeaters pipeline_divergence Re-run to reassess pipeline_differential A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ◐ WEAKENED | review |
3 Inference provenance
| claim | statement | state | gate |
|---|---|---|---|
| C3.1 | Every inference record is authentic and unaltered since sealing. inference records whyContradicted by 3 item(s) dispositioned quarantine: f_142cc19a941e, f_71efc5c471bd, f_28be06d9a674. Requirements ✓ inference-record integrity (digest recomputation) ✓ inference-record signatures against the trust store Defeaters record_altered, signature_invalid, untrusted_signer, record_unsigned, record_unparseable Re-run to reassess inference_provenance A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C3.2 | The inference log is complete, in order, and free of replays. inference records whyContradicted by 4 item(s) dispositioned quarantine: f_18204f947395, f_3359e294716b, f_41dbdae5c7b0, f_b3dd1c50ca77. Requirements ✓ inference log continuity: deletion, reordering, splicing ✓ inference-record replay Defeaters record_replayed, chain_fork, record_deleted, record_reordered, chain_break Re-run to reassess inference_provenance A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C3.3 | Every output is bound to its input image, model and pre/post-processing configuration. inference records whyContradicted by 2 item(s) dispositioned quarantine: f_14dbdc4f1ff6, f_487c3bbca861. Requirements ✓ input binding: substitution versus benign re-encoding ✓ pre/post-processing configuration against the deployment ✓ model identity against the authorised deployment Defeaters input_substituted, input_missing, config_mismatch, model_substitution Re-run to reassess inference_provenance A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
| C3.4 | Every sealed output is what the model would produce on its input. inference records whyContradicted by 7 item(s) dispositioned quarantine: f_3f3cc7f9e937, f_468d360d750e, f_8f8622a8b3a1, f_aa148d8660ff, f_b8a5c3294c21, f_ccba23cbddbb.... Requirements ✓ re-execution of sealed inferences (signed but wrong) Defeaters output_mismatch Re-run to reassess inference_reexecution A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✕ CONTRADICTED | quarantine |
4 Distribution shift
| claim | statement | state | gate |
|---|---|---|---|
| C4.1 | The data matches the declared reference, or its deviation is explained operational drift. deployment data whyWeakened by 9 item(s) held for review, recalibration or as inconclusive: f_1439e225d25d, f_02e9831939d8, f_16dab911c1e4, f_52e822d5ffe5, f_a6bb9fc42d24, f_b2b0ce5ab51b.... Requirements ✓ distribution drift against a reference profile ✓ calibrated shift test (permutation p-value) ✓ drift versus manipulation signatures Defeaters distribution_shift, contributor_shift, class_shift Re-run to reassess distribution_shift A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ◐ WEAKENED | recalibrate |
5 Analyst-facing assurance
| claim | statement | state | gate |
|---|---|---|---|
| C5.1 | Every flag carries a reason, evidence, a confidence, limitations and a recommended disposition. this report whySupported: 882 finding(s) checked; every one carries all five. Requirements ✓ flags_complete A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✓ SUPPORTED | accept |
| C5.2 | The audit ledger this assessment will be appended to is intact. audit trail whyUnresolved: 1 of 1 required assessment(s) did not run - no ledger exists at the store root yet; the first logged assessment creates it. Requirements ○ ledger_intact (did not run) A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ? UNRESOLVED | inconclusive |
| C5.3 | The assessment's own controls passed their known-answer tests before it ran. this assessment whySupported: 5 of 5 known-answer tests passed. Requirements ✓ preflight A supported claim means every listed requirement ran and no defeater reached review - not that the asset is proved safe. Its strength is bounded by the coverage statement and by each requirement's own limitations. | ✓ SUPPORTED | accept |
Provenance
Every inference sealed at the node binds the input image, the model, the pre- and post-processing configuration and the output, and links to the record before it. This stage re-verifies all of it.
edge-01-s1
edge-02-s1
edge-03-s1
What failed, record by record
| record | finding | severity | action | reason |
|---|---|---|---|---|
| edge-01-s1#10 | chain_break | high | quarantine | Record edge-01-s1#10 links to predecessor ee27707fdd74, but the record before it hashes to 155dd7cbaf98: a record was spliced in, or its predecessor was re-sealed. |
| edge-01-s1#12 | untrusted_signer | high | quarantine | Record edge-01-s1#12 is sealed by key k_8d1430090438ecef, which is not one of the 2 key(s) in the trust store: a record produced outside the authorised nodes. |
| edge-01-s1#13 | chain_break | high | quarantine | Record edge-01-s1#13 links to predecessor f1ca89734cff, but the record before it hashes to 8468694d2e3e: a record was spliced in, or its predecessor was re-sealed. |
| edge-01-s1#18 | input_substituted | high | quarantine | The stored input for record edge-01-s1#18 is a different picture from the one the output was computed on: bytes differ and the perceptual hashes are 21 bits apart (radius 6). |
| edge-01-s1#25 | input_transcoded | low | quarantine | The stored input for record edge-01-s1#25 was re-encoded: bytes differ but the perceptual hashes are 0 bit(s) apart, within the radius of 6. Same picture; the exact evidence copy was not kept. |
| edge-01-s1#3 | record_replayed | high | quarantine | Record edge-01-s1#3 at line 73 repeats a sealed digest first logged at line 7: the same inference replayed into the log. |
| edge-01-s1#5 | record_altered | high | quarantine | Record edge-01-s1#5 was edited after it was sealed: its content hashes to 7d6d5d7a10de, not the sealed 744d8f9b13e4. Altered: output. |
| edge-01-s1#9 | signature_invalid | high | quarantine | Record edge-01-s1#9 is internally consistent but its signature does not verify under edge-01's trusted key: the digest was recomputed after an edit, or the signature was forged. |
| edge-02-s1#15 | record_reordered | medium | review | Record edge-02-s1#15 is logged after sequence 16: the log order was changed. |
| edge-02-s1#20 | model_substitution | high | quarantine | Record edge-02-s1#20 names model ffffffffffff, which is not the model its node is authorised to run (deployment registry). |
| edge-02-s1#22 | config_mismatch | medium | review | Record edge-02-s1#22 ran the authorised model with a configuration that is not the authorised one (tinydet-v1): post.score_threshold: 0.25 -> 0.05. |
| edge-02-s1#25 | chain_fork | high | quarantine | Two different records claim edge-02-s1#25: this one and the one at line 50. A session cannot have two records at one position. |
| edge-02-s1#27 | input_missing | medium | review | Record edge-02-s1#27 points at an evidence copy (inputs/edge-02-s1/000027.jpg) that is not in the records directory. |
| edge-02-s1#8 | record_deleted | high | review | Session edge-02-s1 jumps from sequence 6 to 8: 1 record(s) missing (7). |
| edge-03-s1#0 | record_unsigned | medium | review | Record edge-03-s1#0 carries no signature although a trust store is in force. |
| line:72 | record_unparseable | medium | review | Line 72 of the inference log is not a verifiable record: Expecting value: line 1 column 63 (char 62). |
Drift
Is this data still what the reference was - and if not, did the world change, or did someone change the data?
5 of 6 contributor(s) shifted (broad); 3 of 4 class(es) shifted (not class-selective); descriptors reproduce 100% of the separation (physically explained)
A written rule in policy.yaml (shift:) over four measured signatures - not a trained classifier.
By contributor
| contributor | objects | kernel p | nonconforming / expected | q | |
|---|---|---|---|---|---|
| unit_a | 64 | 0.11 | 11 / 2.12 | 0.00219 | SHIFTED |
| unit_b | 61 | 0.0133 | 15 / 1.92 | 0.000234 | SHIFTED |
| unit_c | 71 | 0.532 | 1 / 2.31 | 1 | - |
| unit_d | 61 | 0.0199 | 12 / 1.99 | 0.00173 | SHIFTED |
| unit_e | 30 | 0.00332 | 0 / 0.94 | 0.00797 | SHIFTED |
| unit_f | 15 | 0.00332 | 15 / 0.47 | 0 | SHIFTED |
By class
| class | objects | kernel p | nonconforming / expected | q | |
|---|---|---|---|---|---|
| drone | 67 | 0.0864 | 3 / 2.58 | 0.173 | - |
| jet | 55 | 0.00664 | 15 / 1.67 | 0.00181 | SHIFTED |
| tank | 73 | 0.00332 | 21 / 2.15 | 0.00109 | SHIFTED |
| truck | 107 | 0.00332 | 15 / 3.34 | 0.00886 | SHIFTED |
What the conditions did
| factor | reference | submission | shift | units | q |
|---|---|---|---|---|---|
| brightness | 67.5909 | 66.0233 | -0.15 | reference MADs | 0.0845 |
| contrast | 8.0763 | 8.1266 | +0.02 | reference MADs | 0.51 |
| sharpness | 0.992 | 1.0185 | +0.13 | reference MADs | 0.0845 |
| noise | 0.0326 | 0.0343 | +0.10 | reference MADs | 0.221 |
| saturation | 82.9842 | 74.784 | -0.22 | reference MADs | 0.0845 |
| warmth | -1.1947 | 2.873 | +0.20 | reference MADs | 0.00931 |
| dark_channel | 51.3676 | 50.9483 | -0.04 | reference MADs | 0.149 |
| entropy | 0.5259 | 0.544 | +0.08 | reference MADs | 0.0956 |
| log_area | 5.4874 | 5.6812 | +1.90 | reference MADs | 0.798 |
| jpeg_quality | 92.0 | 92.0 | +0.00 | raw difference (reference constant) | 0.0825 |
Physical descriptors measured at ingest. A shift the descriptors alone can reproduce is expressible as lighting, lens, sensor or compression; one they cannot is something else.
Audit ledger
Every assessment is appended to a Merkle log in the construction Certificate Transparency uses, with a signed tree head after each. Rewriting history breaks every later head; a head held elsewhere catches even a rewrite by someone holding the key.
Model behaviour
The model is run, and what it does is evidence: is it the authorised model, does a small patch turn one class into another, which training samples taught it that, and does every sealed output reproduce?
Trigger inversion - attack success by class pair
Row: the class the patch is pasted on. Column: the class it tries to force. A 8x8 patch, 80 steps, evaluated on held-out crops at held-out positions. Median 0.00. Dark cells surfaced.
| drone | jet | tank | truck | |
|---|---|---|---|---|
| drone | · | 0.00 | 0.00 | 0.00 |
| jet | 0.00 | · | 0.00 | 0.00 |
| tank | 0.11 | 0.00 | · | 0.00 |
| truck | 0.00 | 0.00 | 1.00 | · |
Samples that taught truck->tank
16 of 73 target-class objects sit with the triggered source in the model's own features - unit_b 13, unit_f 3.
Transplant probes through the deployed pipeline
A candidate patch pasted onto clean objects, against a matched control. Flip rate is how often the pipeline then reports the candidate's class.
| candidate | pair | cell | flip | control |
|---|---|---|---|---|
| unit_b_t0169.jpg#0 | truck→tank | 4 | 1.00 | 0.08 |
| unit_b_t0217.jpg#0 | truck→tank | 0 | 0.33 | 0.08 |
| unit_b_t0001.jpg#0 | truck→tank | 0 | 0.88 | 0.21 |
| unit_b_t0021.jpg#0 | truck→tank | 0 | 0.83 | 0.21 |
| unit_b_t0045.jpg#0 | truck→tank | 0 | 0.67 | 0.08 |
| unit_b_t0065.jpg#0 | truck→tank | 4 | 1.00 | 0.12 |
| unit_b_t0085.jpg#0 | truck→tank | 4 | 1.00 | 0.12 |
| unit_b_t0097.jpg#0 | truck→tank | 4 | 1.00 | 0.12 |
| unit_b_t0105.jpg#0 | truck→tank | 0 | 0.79 | 0.08 |
| unit_b_t0121.jpg#0 | truck→tank | 4 | 1.00 | 0.12 |
| unit_b_t0189.jpg#0 | truck→tank | 0 | 0.46 | 0.08 |
| unit_b_t0233.jpg#0 | truck→tank | 0 | 0.71 | 0.17 |
| unit_b_t0093.jpg#0 | truck→tank | 0 | 0.96 | 0.08 |
| unit_b_t0181.jpg#0 | truck→tank | 0 | 0.12 | 0.12 |
| synthesised truck->tank | truck->tank | in box | 0.67 | 0.71 |
Twin-pipeline differential
The same model behind the declared configuration and behind deployment 'tinydet-v1', on 96 images: 19% of outputs change.
| key (applied alone) | declared | divergence | transitions |
|---|---|---|---|
| postprocess.class_map | {"jet": "drone"} | 0.19 | jet->drone x18 |
Engines
| engine | status | why not |
|---|---|---|
| weight_integrity | ran | |
| model_fingerprint | ran | |
| backdoor_scan | ran | |
| poison_localization | ran | |
| model_spectral | ran | |
| behaviour_probe | ran | |
| inference_reexecution | ran | |
| pipeline_differential | ran |
Model findings
| asset | finding | severity | action | axes | reason |
|---|---|---|---|---|---|
| model:backdoored.safetensors | backdoor_trigger | high | quarantine | deterministic, frequency, model_behaviour, semantic, witness | A 8x8 patch, synthesised in 80 steps and pasted at random positions, turns 100% of 46 held-out truck crops into tank, against 0% for the reference (median of other pairs; 12 pair(s) tested): this pair has a shortcut a small local pattern can trigger, which is what a planted backdoor leaves. |
| unit_b_t0169.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 4 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 100% of them; the same cell cut from ordinary tank objects does it for 8%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0001.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 0 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 88% of them; the same cell cut from ordinary tank objects does it for 21%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0021.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 0 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 83% of them; the same cell cut from ordinary tank objects does it for 21%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0045.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 0 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 67% of them; the same cell cut from ordinary tank objects does it for 8%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0065.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 4 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 100% of them; the same cell cut from ordinary tank objects does it for 12%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0085.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 4 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 100% of them; the same cell cut from ordinary tank objects does it for 12%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0097.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 4 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 100% of them; the same cell cut from ordinary tank objects does it for 12%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0105.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 0 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 79% of them; the same cell cut from ordinary tank objects does it for 8%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0121.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 4 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 100% of them; the same cell cut from ordinary tank objects does it for 12%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0233.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 0 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 71% of them; the same cell cut from ordinary tank objects does it for 17%. On the other classes: drone 4%. The model treats this patch on a truck as a reason to say tank. |
| unit_b_t0093.jpg | trigger_behaviour | medium | quarantine | frequency, model_behaviour, semantic, witness | The patch in cell 0 of object 0 (labelled tank), transplanted onto 24 clean truck objects, makes the deployed pipeline report tank for 96% of them; the same cell cut from ordinary tank objects does it for 8%. On the other classes: drone 0%. The model treats this patch on a truck as a reason to say tank. |
| edge-01-s1#12 | output_mismatch | high | quarantine | model_behaviour, provenance | Record edge-01-s1#12 (line 25) seals tank 0.986, but re-running deployment 'tinydet-v1''s model on the bound input with the bound configuration gives drone 0.986 (class drone against tank). The record may verify perfectly: this is the output the model did not produce. |
| edge-01-s1#18 | output_mismatch | high | quarantine | model_behaviour, provenance | Record edge-01-s1#18 (line 37) seals jet 0.965, but re-running deployment 'tinydet-v1''s model on the bound input with the bound configuration gives jet 0.976 (box IoU 0.000). The record may verify perfectly: this is the output the model did not produce. |
| edge-01-s1#25 | output_mismatch | high | quarantine | model_behaviour, provenance | Record edge-01-s1#25 (line 51) seals jet 0.987, but re-running deployment 'tinydet-v1''s model on the bound input with the bound configuration gives jet 0.987 (box IoU 0.273). The record may verify perfectly: this is the output the model did not produce. |
| edge-01-s1#30 | output_mismatch | high | quarantine | model_behaviour | Record edge-01-s1#30 (line 60) seals tank 0.985, but re-running deployment 'tinydet-v1''s model on the bound input with the bound configuration gives drone 0.985 (class drone against tank). The record may verify perfectly: this is the output the model did not produce. |
| edge-01-s1#34 | output_mismatch | high | quarantine | model_behaviour | Record edge-01-s1#34 (line 64) seals no detection, but re-running deployment 'tinydet-v1''s model on the bound input with the bound configuration gives truck 0.976 (1 detection(s) against 0). The record may verify perfectly: this is the output the model did not produce. |
| edge-01-s1#5 | output_mismatch | high | quarantine | model_behaviour, provenance | Record edge-01-s1#5 (line 11) seals truck 0.972, but re-running deployment 'tinydet-v1''s model on the bound input with the bound configuration gives tank 0.972 (class tank against truck). The record may verify perfectly: this is the output the model did not produce. |
| edge-01-s1#9 | output_mismatch | high | quarantine | model_behaviour, provenance | Record edge-01-s1#9 (line 19) seals truck 0.760, but re-running deployment 'tinydet-v1''s model on the bound input with the bound configuration gives tank 0.760 (class tank against truck). The record may verify perfectly: this is the output the model did not produce. |
| model:backdoored.safetensors | behaviour_mismatch | high | quarantine | deterministic, frequency, model_behaviour, semantic, witness | backdoored.safetensors does not behave as deployment 'tinydet-v1': re-running the authorised model on the same 24 public challenge images, the two disagree on the class of 12 and move the box by more than 0.02 of the image on 24 (largest 0.810). Its fingerprint is 6faec123145f37d5.... |
| unit_b_t0169.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 27.0); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0217.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 65.3); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_d_t0139.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1198.3); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_a_t0048.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 5.5); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_a_t0112.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 10.1); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_a_t0156.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 13.2); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_a_t0164.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 31.9); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_a_t0168_relabel0.jpg | model_spectral_signature | high | quarantine | model_behaviour, semantic, witness | Among 67 objects labelled drone, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 5932.2); 4 objects do, with residual coherence -0.14, 50% of them from unit_f. |
| unit_a_t0168_relabel1.jpg | model_spectral_signature | high | quarantine | model_behaviour, semantic, witness | Among 67 objects labelled drone, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 5834.6); 4 objects do, with residual coherence -0.14, 50% of them from unit_f. |
| unit_b_t0001.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 31.4); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0021.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 39.4); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0045.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 26.0); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0105.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 38.4); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0121.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 12.8); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0189.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 72.3); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0233.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 75.6); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_d_t0007.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1280.9); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0019.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1164.0); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0027.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1201.9); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0079.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1238.9); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0099.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1238.4); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0107.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1159.3); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0147.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1189.3); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0155.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1234.5); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_d_t0159.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1225.5); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_f_ood01.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 744.5); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_f_ood02.jpg | model_spectral_signature | high | quarantine | model_behaviour, semantic, witness | Among 67 objects labelled drone, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 5700.8); 4 objects do, with residual coherence -0.14, 50% of them from unit_f. |
| unit_f_ood03.jpg | model_spectral_signature | high | quarantine | model_behaviour, semantic, witness | Among 67 objects labelled drone, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 6281.8); 4 objects do, with residual coherence -0.14, 50% of them from unit_f. |
| unit_f_ood05.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 106.0); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_f_ood06.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 118.9); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_f_ood07.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 653.6); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_f_ood09.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 886.9); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_f_ood10.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 47.1); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_f_ood11.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 876.5); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_f_ood13.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 41.2); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_f_ood14.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 73.3); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
| unit_a_t0136.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 55 objects labelled jet, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 4.3); 9 objects do, with residual coherence 0.03, 56% of them from unit_a. |
| unit_b_t0093.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 49.2); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_b_t0181.jpg | model_spectral_signature | medium | quarantine | frequency, model_behaviour, semantic, witness | Among 73 objects labelled tank, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 139.0); 17 objects do, with residual coherence 0.49, 65% of them from unit_b. |
| unit_d_t0011.jpg | model_spectral_signature | medium | quarantine | model_behaviour, semantic, witness | Among 107 objects labelled truck, this one projects heavily onto the class's top singular direction in backdoored.safetensors's own region features (robust z 1256.5); 15 objects do, with residual coherence 0.74, 80% of them from unit_d. |
Investigation
Data evidence forms hypotheses; the model is asked to confirm them, most promising first. Every experiment is listed with why it ran when it did, and what it measured - including the ones that did not reproduce anything.
Hypotheses
| id | hypothesis | data axes | prior | outcome |
|---|---|---|---|---|
| H1 | objects labelled drone carry an injected trigger that the model learned | semantic | 0.30 | not reproduced by 3 experiment(s); a statement about these experiments, not an acquittal |
| H2 | objects labelled jet carry an injected trigger that the model learned | label, semantic | 0.55 | not reproduced by 3 experiment(s); a statement about these experiments, not an acquittal |
| H3 | objects labelled tank carry an injected trigger that the model learned | frequency, label, semantic, witness | 0.90 | reproduced in the model by E01, E03, E04, E05, E06, E07 and 6 more |
| H4 | objects labelled truck carry an injected trigger that the model learned | label, semantic, witness | 0.80 | not reproduced by 3 experiment(s); a statement about these experiments, not an acquittal |
| H5 | unit_a's tank->jet label flips are poisoning a tank->jet backdoor | label | 0.30 | not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal |
| H6 | unit_b's truck->tank label flips are poisoning a truck->tank backdoor | label | 0.30 | reproduced in the model by E15 |
| H7 | unit_c's drone->jet label flips are poisoning a drone->jet backdoor | label | 0.30 | not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal |
| H8 | unit_d's tank->truck label flips are poisoning a tank->truck backdoor | label | 0.30 | not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal |
| H9 | unit_f's truck->jet label flips are poisoning a truck->jet backdoor | label | 0.30 | not reproduced by 1 experiment(s); a statement about these experiments, not an acquittal |
| H10 | the model carries a patch-triggered backdoor that left no trace in this data | none | 0.05 | untested |
Experiments, in the order they were scheduled
priority = prior x power / cost; scheduled in order until the budget is spent; the first inversion carries 3 reference pair(s)
| id | experiment | tests | priority | status | measured | outcome |
|---|---|---|---|---|---|---|
| E01 | unit_b_t0169.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 1.0, "control_rate": 0.0833} | reproduced |
| E02 | unit_b_t0217.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.3333, "control_rate": 0.0833} | not reproduced |
| E03 | unit_b_t0001.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.875, "control_rate": 0.2083} | reproduced |
| E04 | unit_b_t0021.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.8333, "control_rate": 0.2083} | reproduced |
| E05 | unit_b_t0045.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.6667, "control_rate": 0.0833} | reproduced |
| E06 | unit_b_t0065.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 1.0, "control_rate": 0.125} | reproduced |
| E07 | unit_b_t0085.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 1.0, "control_rate": 0.125} | reproduced |
| E08 | unit_b_t0097.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 1.0, "control_rate": 0.125} | reproduced |
| E09 | unit_b_t0105.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.7917, "control_rate": 0.0833} | reproduced |
| E10 | unit_b_t0121.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 1.0, "control_rate": 0.125} | reproduced |
| E11 | unit_b_t0189.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.4583, "control_rate": 0.0833} | not reproduced |
| E12 | unit_b_t0233.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.7083, "control_rate": 0.1667} | reproduced |
| E13 | unit_b_t0093.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.9583, "control_rate": 0.0833} | reproduced |
| E14 | unit_b_t0181.jpg#0 | H3 | 0.90 x 0.6 / 0.2 = 2.700 | scheduled | {"flip_rate": 0.125, "control_rate": 0.125} | not reproduced |
| E15 | invert truck->tank | H3,H6 | 0.90 x 0.8 / 2.0 = 0.360 | scheduled | {"asr": 1.0} | reproduced |
| E16 | invert tank->truck | H4,H8 | 0.80 x 0.8 / 2.0 = 0.320 | scheduled | {"asr": 0.0} | not reproduced |
| E17 | invert drone->jet | H2,H7 | 0.55 x 0.8 / 2.0 = 0.220 | scheduled | {"asr": 0.0} | not reproduced |
| E18 | invert tank->jet | H2,H5 | 0.55 x 0.8 / 2.0 = 0.220 | scheduled | {"asr": 0.0} | not reproduced |
| E19 | invert truck->jet | H2,H9 | 0.55 x 0.8 / 2.0 = 0.220 | scheduled | {"asr": 0.0} | not reproduced |
| E20 | invert drone->tank | H3 | 0.30 x 0.8 / 2.0 = 0.120 | scheduled | {"asr": 0.0} | not reproduced |
| E21 | invert jet->tank | H3 | 0.30 x 0.8 / 2.0 = 0.120 | scheduled | {"asr": 0.0} | not reproduced |
| E22 | invert drone->truck | H4 | 0.27 x 0.8 / 2.0 = 0.107 | scheduled | {"asr": 0.0} | not reproduced |
| E23 | invert jet->truck | H4 | 0.27 x 0.8 / 2.0 = 0.107 | scheduled | {"asr": 0.0} | not reproduced |
| E24 | invert jet->drone | H1 | 0.10 x 0.8 / 2.0 = 0.040 | scheduled | {"asr": 0.0} | not reproduced |
| E25 | invert tank->drone | H1 | 0.10 x 0.8 / 2.0 = 0.040 | scheduled | {"asr": 0.1111} | not reproduced |
| E26 | invert truck->drone | H1 | 0.10 x 0.8 / 2.0 = 0.040 | scheduled | {"asr": 0.0} | not reproduced |
Witness audit
A local vision-language model asked three closed questions about every object. This is its opinion - what it named each class, where it disagreed, and how often an independent engine agreed with it - so an analyst can see what its flags are worth before acting on them.
What it was asked, verbatim
| label | Which of these is the main object in this image? |
| marking | Does the main object carry a sticker, a patch, a checkerboard, a printed pattern or any other unusual marking that is not part of its normal insignia, numbers or camouflage? |
| scene | Is this a real photograph (not a render, drawing, painting or screenshot)? |
What it was told each class means
Declared by the assessor, beside witness.json - never taken from the submission, because whoever writes it can steer the answers.
| none declared - the witness saw the bare class names, and reads a code like land as English |
What it named, per declared class
| declared class | objects | named it | when it did not, it chose | label flags | marking flags | scene flags |
|---|---|---|---|---|---|---|
| drone | 67 | 0% | none of these 61, tank 6 | 65 (97%) | 0 (0%) | 67 (100%) |
| jet | 55 | 0% | none of these 51, tank 4 | 54 (98%) | 0 (0%) | 55 (100%) |
| tank | 73 | 34% | none of these 48 | 46 (63%) | 14 (19%) | 73 (100%) |
| truck | 107 | 0% | none of these 106, tank 1 | 105 (98%) | 1 (1%) | 107 (100%) |
A class it rarely names is either mislabelled, genuinely confusable with the class it chose, or named by a code it cannot read - the per-class row says which class, never which of the three.
What its flags are worth
- label - 270 flag(s). 206 rest on the witness alone (measured precision 16% for a lone flag of this type); 64 are corroborated by at least one other independent axis (57% at 2 axes, 90% at 3+ axes). 40 coincide with a swapped_label flag from the embedding neighbour vote on the same object.
- marking - 15 flag(s). 1 rest on the witness alone (measured precision 5% for a lone flag of this type); 14 are corroborated by at least one other independent axis (93% at 3+ axes). 14 coincide with a trigger_texture flag from the high-frequency texture scan on the same object.
- scene - 302 flag(s). 218 rest on the witness alone (measured precision 0% for a lone flag of this type); 84 are corroborated by at least one other independent axis (7% at 2 axes, 25% at 3+ axes). 44 coincide with a out_of_distribution flag from the kNN / Mahalanobis outlier test on the same object.
"Measured precision" is the attack harness's: of such findings in its planted-truth scenarios, the share that named a real planted defect. A flag only the witness raises is an opinion to review; the correlation layer never lets it quarantine alone.