Model Assurance Solution

Determine where a model came from. Confirm it has not changed.

The Model Assurance Solution verifies the AI model inside a supplied system. It assesses the model once at source selection, confirms the installed model matches in an installation audit, and then monitors it continuously as an ongoing service while the system is in operation.

Stage 01 · Source selection

A detailed provenance inspection, using validated, published methods.

The full assessment runs once, when a model is offered. It examines the model at two levels: weight analysis reads lineage directly from the trained parameters, and behavioral fingerprinting characterizes what the model does. Each detects cases the other misses. Both methods are validated in published research. The evidence report is the basis for approval.

Fig. 1 — Source selection assessment
RUNS INSIDE YOUR ENVIRONMENT — ON-PREMISES OR AIR-GAPPED INPUT Candidate model open-weight model under evaluation Source selection assessment FINGERPRINTS GENERATED 1 Behavioral fingerprint how the model maps fixed inputs to outputs 2 Weight-derived signals five signals computed from the trained weights 3 Tokenizer comparison tokenizer structure and vocabulary overlap 4 Architecture metadata layer layout, dimensions, configuration each compared against a reference catalog of known models OUTPUT Evidence report one artifact — structured, storable, exportable Behavioral neighbors Weight-lineage matches Tokenizer and architecture matches Combined reading BEHAVIORAL FINGERPRINT RETAINED AS BASELINE FOR STAGES 02–03 NO WEIGHTS CROSS THE BOUNDARY · NO CALL-HOME
Run once, at source selection. VAIL produces the behavioral fingerprint. Cisco Model Provenance Kit produces weight, tokenizer, and architecture signals. All four are compared against a reference catalog of known models and combined into one evidence report, usable for provenance records and AI bill of materials (AIBOM) documentation. The behavioral fingerprint in the report becomes the baseline for stages 02 and 03.
Weight analysis · Cisco MPK

Lineage classification

Classifies the model as a direct descendant, fine-tune, quantization, or merger of a known base — or as independently trained. Reads the weights directly, so renaming and metadata removal do not affect the result. Requires access to the weights.

Behavioral fingerprint · VAIL

Behavioral identity

A compact vector derived from the model's output distributions on a fixed probe set. Detects divergence from a parent that weight analysis misses, such as a fine-tune that changes refusal behavior. Works on a served model without weight access.

Inspection points

Three inspection points. One baseline.

Example: a drone supplied by an external vendor, with a model on board.

Fig. 2 — Inspection points across the acquisition life cycle Example: vendor-supplied drone
01 · SOURCE SELECTION 02 · INSTALLATION AUDIT 03 · CONTINUOUS MONITORING baseline carried forward baseline carried forward ON-PREMISES OR AIR-GAPPED Evaluate the offered model vendor submits the model full assessment (Fig. 1) approved or rejected METHOD · BEHAVIORAL WEIGHT ANALYSIS OUTPUT · EVIDENCE REPORT AND BASELINE AT DELIVERY Verify the installed model drone delivered with model on board behavioral fingerprint taken matched to the stage 01 report METHOD · BEHAVIORAL ONLY OUTPUT · MATCH OR MISMATCH ON THE DEVICE, OFFLINE Monitor in operation service enabled on the drone behavioral fingerprint, ongoing drift or change flagged locally METHOD · BEHAVIORAL ONLY OUTPUT · STABILITY STATUS
Weight analysis runs only at stage 01. Stages 02 and 03 use the behavioral fingerprint alone, matched against the fingerprint in the stage 01 evidence report. Stage 02 is a one-time check; stage 03 is an ongoing service that keeps checking until turned off. Every stage runs on customer or device hardware; reference catalog updates are small vector files that can be moved across an air gap.
Sources

Published research.

Cisco
Joint study · Cisco and VAIL · August 2026

Models don't have passports: AI lineage crosses organizational and geographic borders

Amy Chang, Ankit Garg (Cisco) · Manish Shah, Jonah Leshin (VAIL)

Applies both methods to NVIDIA Nemotron models, some of which are documented as post-trained from Alibaba Qwen base weights. Independently, each method places Qwen models disproportionately among those models' nearest neighbors and recovers the documented lineage ordering: Qwen-base, then NVIDIA-native, then Llama-base. Results are detection evidence consistent with documented lineage, not proof of derivation.

Read the paper (PDF) →
Weight analysisBehavioral
Qwen-neighbor enrichment, Qwen-base Nemotron models1.74×1.89×
Lineage ordering recovered (permutation test)p = 0.00001p = 0.00002
Reference catalog184 models1,159 models
VAIL · ACM CAIS 2026 · System demonstrations

Behavioral Fingerprints for LLM Endpoint Stability and Identity

Jonah Leshin, Manish Shah, Ian Timmis, Daniel Kang

Describes the behavioral fingerprinting method and a monitor that fingerprints a model periodically from a fixed prompt set and compares output distributions over time. In real-world monitoring of the same model hosted by multiple providers, it finds substantial stability differences between and within providers. This is the method used for installation audit and continuous monitoring.

Read the paper (arXiv:2603.19022) →
Change to the modelDetected
Model familyYes
Model versionYes
Inference stackYes
QuantizationYes
Behavioral parametersYes
Joint study · Lucid Computing, Lunal, and VAIL · ICDS 2025

Hardware-Rooted Trust Anchors for Sovereign AI Processing: Cryptographic Verification of Location, Identity, and Confidentiality in Cloud Environments

Milos Borenovic, Connor Dunlop, José Dunia (Lucid Computing) · Amean Asad (Lunal) · Manish Shah, Jonah Leshin (VAIL)

Verifies an AI workload running on untrusted infrastructure by combining hardware trusted execution, network-based location attestation, and VAIL's input–output fingerprint for runtime model integrity. The fingerprint check applies to stages 02 and 03: confirming the identity of a model that is already running. It is stable across machines and quantization and separates independently trained models.

Read the paper (PDF) →
Result
Base model vs. its instruction-tuned version (4 pairs)0.96–0.98
Qwen3-32B vs. quantized versions> 0.91
Qwen3-32B vs. unrelated models of similar size0.63–0.84
Derivation threshold0.85
Inference runs per fingerprint≈ 100

Software: Cisco Model Provenance Kit, mapped to Cisco AI Security Framework controls OB-009, AITech-9.2, and AITech-9.3. Live behavioral measurements across inference providers: Stability Arena.