How to meet it
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Model Authorization & Integrity
Sign every model artifact
Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.
OWASP AISVS v1.01, requirement 3.1.2
In plain English
Sign every model artifact, including weights, configuration, tokenisers and adapters, so you can prove who produced it and that it has not changed.
What good looks like
- All artifact types are signed, including adapters and tokenisers.
- Only authorised build systems or people hold signing keys.
- Signatures are recorded in the model registry.
How teams usually do it
- Sigstore or a similar signing tool in the training or packaging pipeline.
- Keys kept in a key management service, with signing done by the pipeline identity.
Evidence an auditor would accept
- Signatures stored with artifacts.
- Key access policies showing who can sign.
Common mistakes
- Signing weights but not the tokeniser or configuration, which can change behaviour too.
- Signing keys on a developer's laptop.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.