Solutions / Open-weight models
Provenance
You are about to run a model nobody in your company has verified.
Open-weight and self-hosted models are absorbing real production workloads, and that decision is usually already made by the time security is asked about it. The provenance question behind it is still open.
The problem
A backdoored model passes every benchmark you run.
Models arrive from repositories, vendors, and fine-tuning pipelines. Each hop is a step nobody attested, and the tests you run cannot see any of them.
01
You cannot inspect the training
Someone else chose the data, the objectives, and the alignment. In some cases under another jurisdiction's requirements.
02
Benchmarks do not detect intent
A model with a trigger-conditioned backdoor scores exactly like a clean one, because the trigger is not in your test set.
03
The download is the supply chain
Fine-tunes, quantizations, and community re-uploads each add a step nobody attested. You inherit all of them.
What actually runs
The model you run is rarely the model the vendor released.
Teams adapt open models for performance, size, and behavior before they ship. Every change produces a new artifact, and any vendor evaluation of the original no longer applies to it.
Fine-tuned
Retrained on your data or a third party's, changing what the model learned.
Quantized or distilled
Shrunk to run faster and cheaper, with weights that no longer match the release.
Abliterated
Safety refusals stripped out, often by a community re-upload under a familiar name.
Merged
Combined with other models' weights into something no vendor has tested.
Before it runs
Verify the model before it serves a request.
Model Scan fingerprints internal structure against an approved baseline and surfaces trigger-conditioned behavior that benchmarks cannot reach. It runs as a gate in your pipeline, so an unverified model does not reach production.
Fingerprint
Structural fingerprinting
Weights, activations, and architecture against the approved baseline.
Analyze
Backdoor detection
Activation analysis and circuit tracing, not behavioral sampling.
Attest
Attested provenance
An audit-ready record of what you deployed and why it was approved.
Approved
Serves in production
Becomes the trusted baseline runtime detection measures against.
Quarantine
Never serves
A forensic report is generated for the deploying team.
While it runs
Approval is not a one-time check.
Every fine-tune, quantization, and vendor update re-enters the loop, and the approved model keeps being verified after it ships.
Runtime substitution
Model identity verified as it executes, flagging weights that were swapped, tampered with, or silently updated after approval.
Fine-tune drift
Detects what changed inside a model after fine-tuning or quantization, not merely how its outputs shifted.
Only approved models get traffic
At the gateway, only models that passed the scan receive requests.
Enabled by
Bring a model. We will tell you what is inside it.
A working session against a model you are about to deploy, or four minutes with the diagnostic.