Model signing with Sigstore (model-transparency)

What it is

Sigstore is an open source project, part of the OpenSSF (Open Source Security Foundation) community, that makes signing software easy and verifiable. The model-transparency repository brings the same idea to machine learning models. Its README sums it up as supply chain security for ML.

A model is not one file: it is weights, configuration, tokenizer files and more. The tool computes a hash (a fingerprint) of every file, builds a manifest of file paths and hashes, and signs that manifest. The signature is stored in the Sigstore bundle format. Anyone who downloads the model can recompute the hashes and check the signature, which tells them two things: the files have not changed since signing, and who signed them.

Signing options

The project supports several ways to sign:

• Sigstore (the default), which ties the signature to an identity such as a CI workflow or an email account and records it in a public transparency log.
• Traditional key pairs.
• Certificates.
• PKCS #11 hardware devices.

Is it worth your time?

If you are studying the data and model supply chain, yes. Model files are one of the newest dependencies teams pull from the internet, and most are used without any check of where they came from. Signing does not prove a model is safe to use: a model can be signed and still be poisoned or badly trained. What it gives you is provenance and integrity, which are the base for any trust decision, just like signed packages and container images.

Trying it on a small model you trained or converted yourself shows how the pieces fit: hashes, a manifest, an identity and a verification step you can run in CI before deploying.

How to use it well

• Sign a small model you control, then change one file and watch verification fail.
• Add verification to a deployment script so only signed models from your own pipeline load in production.
• Combine it with safe formats such as safetensors and a list of the models you use, often called an AI bill of materials.

Free or paid?

Free and open source under the Apache 2.0 licence.