Securing the AI supply chain
Every artifact signed. Every receipt verifiable. Every number reproducible.
Eight categories of artifact, each carrying the evidence actually held for it — from a third-party listing we cannot check, through a publisher hash we have not verified, to weights we downloaded and hashed ourselves. Every entry is written to a transparency log whose inclusion proofs you can replay yourself.
A third party reports this artifact exists and we have recorded their numbers. We hold no weights and no publisher hash — nothing of our own to check against.
We hold the publisher's own hash for these weights, logged and signed — but we have not yet downloaded them and checked it ourselves.
We downloaded the weights and checked their SHA-256 ourselves, plus a supply-chain scan mapped to NIST AI RMF / COSAIS — signed by our own key.
Domain attestation by external bodies (NIST, FDA, MITRE…) signing with their own keys. Retired until real reviewers sign — never claimed without receipts.
Research
How it works
Every entry carries an attestation signed by us, recorded in a transparency log whose inclusion proofs you can replay without asking us anything.
Every attested model in the registry, ranked on the Artificial Analysis Intelligence Index — their measurement, not ours, and attributed as theirs. Filter by task (coding, reasoning, vision), parameter count, license, or hardening tier.
Every model ships with a signed AIEM envelope anchored to the Rekor transparency log. Re-check signatures and Merkle inclusion proofs — in your browser or one CLI command.
Pull verified weights with one command. Deploy to cloud, on-prem, or air-gapped edge with a signed provenance bundle attached — no call-home, no single point of trust.
Browse the commons
Each category is a separate signing scope with its own SOTA leaderboard and hardening harness. All eight interoperate through the shared provenance DAG.
Start here
Three on-ramps depending on your role. Every path ends at the same cryptographic foundation.
Pull signed weights and verify the provenance chain end-to-end — against a transparency log you can check yourself, without trusting this host.
Stand up a local mirror, load the air-gap bundle, and integrate with on-premises systems — no call-home, no single point of trust. Verified attestation chains work fully offline.
Bring your model, dataset, or tool into the commons. One CLI command mints an AIEM envelope, runs the scan harness, and anchors the attestation in the transparency log.
Attestation pipeline
A tier is a claim about evidence held, not about quality. A model enters at Closed if a third party is all we have, or at Quarantine if the publisher has published a hash — and it reaches Hardened only once we have downloaded the weights and checked that hash ourselves, alongside a static supply-chain scan, signed with our own key and mapped to NIST AI RMF, COSAIS (SP 800-53 overlays), and the CAISI agent-security RFI. Nothing here is signed by the publisher, and we do not claim otherwise.
A third party reports the model and we have recorded their figures. We hold no weights, no publisher hash, and ran no evaluation of our own. The largest tier here, and the one that asserts least.
The publisher has published a hash for the weights and we have not verified it ourselves yet. Everything harvested lands here. It means catalogued, not vouched for.
We downloaded the weights, checked their SHA-256 against the publisher's git-LFS hashes, and ran a static supply-chain scan for serialization safety and load-time code execution — signed with our key.
A fourth tier, Sealed, was retired and nothing has replaced it: no outside reviewer signs anything here today. It stood for independent third-party attestation, and it comes back when real reviewers sign with their own keys — not before.