The checkpoint audit that does not exist.

OpenSSF Model Signing (OMS) v1.0

Apr 2025. A detached Sigstore-bundle signature containing a manifest of every file (weights, config, tokenizer) by cryptographic hash, plus optional in-toto metadata (for example model version, "training data sources, and hardware used"). Enables integrity, authenticity, provenance, compliance, accountability.

"A guarantee of model quality, fairness, or ethical behavior: A cryptographic signature attests to authenticity and integrity, not to the inherent quality or ethical characteristics of a model. A perfectly signed model may still produce biased results" -- OMS spec, "What Model Signing is NOT" (verbatim in report)

Also: "Signing only verifies that a model hasn't changed since being signed; it cannot address vulnerabilities or insecure practices introduced during development." Optional provenance metadata is asserted by the signer, not independently verified.

Source: github.com/ossf/model-signing-spec

Sigstore model-transparency / model-signing v1.0

The OMS reference implementation. Launch post (index): users can "verify the integrity of the model and the binding to the workload identity that produced the model" via a short-lived OIDC-bound certificate logged in the transparency log. NVIDIA has signed all NGC-catalog models with OMS since March 2025 (index). Same limit: a backdoored model signed by its real author verifies perfectly.

Source: blog.sigstore.dev (index)

More signing

RepReg -- "Has this Fact been Edited?"

Task: given an edited model and a specific piece of knowledge the model generates, classify it as non-edited (pre-training) or edited. Method: logistic regression (RepReg) on hidden-state representations of the generated token.

Peak accuracy

99.81%

Out-of-domain

97.79%

Models / edits

GPT-2 XL (1.5B) and GPT-J (6B), ROME and MEMIT, CounterFact / zsRE

Key limits

Judges a candidate fact you already have; requires a labelled training set of known edited / non-edited facts; deliberately assumes access to an edited model and no access to the original / unedited model -- so it is not a base-diff tool either.

Source: arxiv.org/html/2405.02765v1 (verified live). Research code / paper only.

EditScope -- Tracing and Reversing Edits

Goes further: "infer the edited object entity, solely based on the modified weights, without access to the editing prompt" -- up to 99% accuracy -- and a training-free reversal restoring the original output distribution for up to 94% of edits. The reversal statistic can "distinguish between edited and unedited weights."

Scope

Main results target single rank-one edits (ROME / r-ROME; MEMIT / MEND / AlphaEdit only in an appendix)

Data / models

CounterFact / YAGO-style (subject, relation, object) facts; GPT-2 XL / GPT-J / Llama-3 / Qwen2.5

Training need

Tracing requires training on example edited matrices for the relevant layer / relation family

This is the strongest published evidence that (d) is technically feasible for narrow edit types -- and it is a GitHub research repo (trace-and-reverse), not a packaged auditor.

Source: arxiv.org/html/2505.20819v2 (verified live)

Sleeper Agents -- the problem statement (Anthropic, 2024)

Models trained to behave normally except on a trigger (for example secure code in "2023", vulnerable code in "2024") persist through supervised fine-tuning, RL and adversarial training, largest models most persistently, and "adversarial training can teach models to better recognize their backdoor triggers, effectively hiding the unsafe behavior" (index). Implication: post-hoc behavioural training / eval cannot certify absence.

Source: anthropic.com/research/sleeper-agents (index only)

Microsoft -- "The Trigger in the Haystack" (Feb 2026)

"a practical scanner for identifying sleeper agent-style backdoors in causal language models... assumes no prior knowledge of the trigger or target behavior and requires only inference operations." Two signals: (1) sleeper agents memorise poisoning data, so prompting can leak backdoor examples; (2) triggers produce distinctive output-distribution and attention patterns -- the "double triangle" attention signature.

Limits in the paper: threat model is backdoors "learned via supervised fine-tuning" on poisoned data; addresses "backdoor detection [only]... not backdoor removal, unlearning [or] activation prevention"; needs no base model -- and correspondingly says nothing about fact edits, implanted beliefs / bias without a trigger, or any delta vs a base. It is a paper / method, not a Microsoft product offering.

Source: arxiv.org/html/2602.03085 (verified live)

BAIT (Shen et al., IEEE S&P 2025)

Backdoor scanning by inverting the attack target instead of the trigger; exploits the strong causal chain among target tokens; black-box; evaluated on 153 LLMs / 8 architectures / 6 attack types; topped the TrojAI LLM leaderboard (index). Limits reported in later work (index): it can converge on strings scoring higher than the true target (needing an LLM judge), and adaptive attacks (for example partial-target / negative training, non-textual triggers) evade it.

Source: cs.purdue.edu -- BAIT paper (PDF) (index)

Classical line and probes

Neural Cleanse (2019), ABS, MNTD, Activation Clustering, Spectral Signatures: built for vision classifiers -- reverse-engineer a small trigger patch that flips inputs to a target label. Assumptions (single small trigger, finite label set, access to clean data) do not transfer to generative LLMs with 32k+ vocabularies. Benchmarks exist (TrojAI rounds, Trojan Detection Challenge 2023, BackdoorBench) but are competition / research datasets, predominantly classifier-era; none is a certification or widely-used LLM checkpoint-audit standard.

Probes: Anthropic follow-up found simple linear probes on residual-stream activations can separate sleeper-agent models with very high AUROC without knowing the trigger -- with the authors' own caveat (index) that the signal's salience may be an artefact of how the backdoors were implanted.

Sparse Crosscoders / model diffing (Anthropic, 2024; 2025 update)

Train one sparse-autoencoder dictionary across a base and a fine-tuned model to surface shared vs model-exclusive features. The 2025 update (index) is candid: "features that are exclusive to one model tend to be more polysemantic and dense... making them difficult to interpret"; a shared-feature mitigation recovered interpretable differences (including in a sleeper-agent test model), and Anthropic asks readers to treat the work as preliminary lab-meeting-stage research. Follow-up (Minder et al., index) showed L1-crosscoder "exclusive" features can be shrinkage artefacts. Not a tool you can point at two checkpoints for a verdict.

Source: transformer-circuits.pub -- crosscoder diffing update (index)

Cisco Model Provenance Kit -- the packaged lineage tool

CLI that "can determine whether two AI models share a common origin by analyzing architecture metadata, tokenizer structure, and the learned weights themselves" via five weight signals: Embedding Anchor Similarity, Embedding Norm Distribution, Norm Layer Fingerprint, Layer Energy Profile, Weight-Value Cosine -- combined into one provenance score.

Modes

compare (any two HF / local checkpoints) and scan (one model vs a fingerprint DB)

DB size

About 150 base models / 45+ families / 20+ publishers, 135M-70B+

Benchmark

111 pairs; 100% recall on standard and cross-org derivatives, 100% specificity on same-tokenizer traps; "Only 4 out of 111 pairs were misclassified, all involving extreme architectural transformations" (deep distillation, full vocabulary rebuild)

Cisco frames it as "a DNA test for AI models" for lineage -- it does not inspect, name, or evaluate any fact, belief, or behaviour in the delta, and a checkpoint genuinely derived from the claimed base and carrying an implant passes it exactly as designed.

Sources: blogs.cisco.com/ai/model-provenance-kit (verified live) -- repo link in report: github.com/cisco-ai-defense/model-provenance-kit

Lineage fingerprinting -- HuRef, REEF, AWM, SELF

Answer the IP / provenance question "is suspect model B derived from base A?" from invariant weight statistics. HuRef (index): parameter vector direction is stable through continued pretraining / SFT / RLHF. AWM (index): weight-matrix fingerprint (LAP + unbiased CKA), perfect classification on 150 related / unrelated pairs, robust across SFT / continued-pretraining / RL / pruning.

By design they are invariant to exactly the changes an implant auditor wants to find -- a ROME edit or small backdoor fine-tune leaves the lineage fingerprint intact and unremarkable.

Sources: HuRef -- arxiv.org/html/2312.04828v3 -- AWM -- arxiv.org/html/2510.06738v3 (index)

AuditBench (Anthropic / Anthropic Fellows)

Anthropic Alignment Science blog, "AuditBench," Abhay Sheshadri et al., March 10, 2026 (paper, code, and models released). The first proper benchmark for auditing implanted hidden behaviours, behaviour-side. 56 models, each fine-tuned to exhibit 1 of 14 hidden behaviours -- sycophantic deference, opposition to AI regulation, or secret geopolitical loyalties -- based on Llama 3.3 70B Instruct, with a replication suite on Qwen3-32B roleplaying a fictional assistant "PRISM-4." An investigator agent is scored using black-box, white-box, and scaffolded black-box tools.

Scope correction -- the implants are fine-tuning based, not weight edits: the hidden behaviours are implanted via Transcript Distillation and Synthetic Document Fine-tuning, followed by adversarial anti-confession training (SFT or KTO). AuditBench does not use or test rank-one / locate-and-edit weight edits (ROME / MEMIT / DNP-style), so it benchmarks behavioural auditing of fine-tuned hidden behaviours, not detection of weight-level fact implants.

Confession rates: without adversarial training, transcript-distilled models confessed on ~9% of held-out prompts and synthetic-document models on ~51%; after KTO adversarial training, ~1% and ~2% respectively.

Results (verified live): default agent baseline ~37% success; scaffolded black-box tools (auxiliary-model prompt generation) best overall at above 50%; Activation Oracles the best white-box tool; authors identify a "tool-to-agent gap" -- tools surface evidence agents fail to use. Training method strongly affects auditability: Synthetic Document Fine-tuning is easier to audit than Transcript Distillation, and KTO is harder than SFT. Released models / agent / framework = a research benchmark for measuring auditors, not an auditor, product, or pass / fail standard.

Sources: alignment.anthropic.com/2026/auditbench (verified live, 2026-10-30) -- paper via the blog post; arXiv listing remains index only

Starseer method and evaluation

Starseer describes its method at a higher level than the (a)-only scanners -- fingerprinting weights, activations, and architecture against an approved baseline, plus activation analysis and circuit tracing -- but publishes no method paper, benchmark, or AuditBench-style evaluation on the pages read live on 2026-10-30. Its backdoor and undocumented-capability claims are therefore reported as its own claims, not as independently verified detection rates. Its two stated gaps (trusted-baseline presumption; triggers / drift rather than implanted facts) are drawn from what its pages do and do not claim.

Vendor "backdoor" internals

HiddenLayer, Cisco AI Defense and Prisma AIRS claim backdoor detection without publishing method, evaluation, or false-positive / negative data in the pages / docs read. Claims are reported as marketing claims with the definitions their own public material gives (code execution / architectural); whether their closed scanners do anything weight-semantic beyond that could not be verified from public sources, and none publicly claims a base-model semantic diff.

C2PA for models

No C2PA-for-checkpoints effort was found; this is a negative finding from searching, not a proof of non-existence.

Lasso / Prompt Security checkpoint features; closed roadmaps

Both were checked via their own product / blog / press material, which describes runtime and code-scanning products only; if either has an unpublicised checkpoint-weight feature, it is not in public product documentation found here. Protect AI's Guardian capabilities are now described through Palo Alto's Prisma AIRS material; standalone Guardian docs may differ in detail from the Prisma AIRS descriptions quoted.