Topic starter
27/10/2026 7:14 pm
TL;DR: A fine-tuned model can be signed, scanned and attested while still hiding what it was built from, according to Jozu, because artifact-level verification does not prove the provenance of its inputs. The missing control is graph verification that follows digests back through base models and datasets before release.
Editorial analysis by NHI Mgmt Group, based on content published by Jozu: “Signing Is Not Enough: Why AI Artifact Provenance Needs to Be a Graph”.
Key questions
Q: How should teams prove what a fine-tuned model was built from?
A: Teams should prove composition by recording every consumed input by digest at build time and attaching a signed provenance attestation to the output.
Q: Why do signed AI artifacts still leave a governance gap?
A: Because a signature proves integrity of the final artifact, not that the artifact was assembled from approved or policy-compliant inputs.
Q: How should teams validate third-party model provenance before deployment?
A: They should validate provenance as part of a formal intake process that includes source review, conversion review, and trigger testing.
Practitioner guidance
- Record consumed inputs by digest Capture the base model and dataset digests before fine-tuning starts, and write them into the build provenance so downstream verification can match what was actually used.
- Bind provenance to the build identity Ensure the pipeline identity that runs fine-tuning is the same identity that signs the resulting attestation, so the provenance record is attributable and auditable.
- Verify the upstream attestation chain recursively Check the final model, then resolve each resolved dependency and confirm its required import or scan attestations before promotion to production.
Bottom line: A fine-tuned model can be legitimately signed and still hide unverified upstream inputs if the build record does not bind the inputs by digest.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →