Model artifacts: verify digest, origin and loading format

Last updated: 6 Oct 20265 min read

tutorial

The file loaded by a serving process must be the exact reviewed artifact, and its loader must match the trust level of its origin.

Treat the artifact as executable input

A model directory can contain weights, tokenizer files, feature mappings and loader metadata. Some serialization formats can execute code during loading; a matching filename is not proof of safety. Accept artifacts only from an approved build path and use a loader appropriate for that format and trust boundary. Keep a manifest of required files and digests, then compare bytes before use. Run lineage explains where the files came from; the digest check verifies which bytes arrived.

Bind bytes to the reviewed release

A registry alias can move from one version to another. Resolve the alias to an immutable artifact digest during promotion, and put that digest in the deployment record. A server should refuse to load a directory with an unexpected file, missing file or hash mismatch. Hashing confirms integrity relative to a trusted manifest; it does not prove the manifest itself is honest. Protect the manifest through a separately trusted release channel. Promotion gates should evaluate the same digest that serving will load.

Keep loader authority narrow

Loading an untrusted Python object in the serving process can give the object the privileges of that process. Prefer restricted data formats and explicit model construction when the system allows it. If a trusted legacy format is unavoidable, isolate build and inference identities, restrict file origins and test the loader in a disposable environment before promotion. Never download a model artifact from a mutable URL at process startup without pinning its digest and origin policy.

Drill a tampered package

Alter one byte of a model file, remove a vocabulary file and change a manifest entry in a test package. Each case should fail before the serving pointer changes. Record the rejected digest and reason without echoing secrets or full file contents. The trusted promotion project combines digest verification with registry, contract and rollback checks.

Implementation

from hashlib import sha256

def verify_artifact_files(files, expected_digests):
    if set(files) != set(expected_digests):
        return {"state": "reject", "reason": "file-set"}
    for name, expected in expected_digests.items():
        actual = sha256(files[name]).hexdigest()
        if actual != expected:
            return {"state": "reject", "reason": "digest", "file": name}
    return {"state": "verified", "files": len(files)}

package = {"weights.bin": b"receipt-model-r8",
           "features.json": b'{"amount_minor":"cent"}'}
digests = {name: sha256(content).hexdigest()
           for name, content in package.items()}
assert verify_artifact_files(package, digests)["state"] == "verified"
assert verify_artifact_files({**package, "weights.bin": b"changed"},
                             digests)["state"] == "reject"

Performance and operating cost

Hashing all files takes O(B) time for B artifact bytes and O(1) streaming memory per file, apart from the in-memory bytes used in this compact example. Verify before activation and cache the result for immutable digests. A hash alone does not authenticate who issued the expected manifest or make an unsafe deserializer safe.

Common Mistakes

Trusting a registry alias without resolving its immutable digest.
Loading a package before checking every required file.
Treating a hash as proof that the manifest issuer is trusted.
Deserializing unknown objects inside the privileged serving process.