Model Forensics

Scope

The examined system may combine a base model, fine-tuned weights, adapters, retrieval sources, safety policies, routing, and tools. Define whether the question concerns a model file, an endpoint, a model family, or the whole deployed workflow. These are different attribution levels. Only inspect weights or proprietary records when legitimately available.

Why the field matters

A changing service alias can obscure which implementation answered a historical request. A local deployment can use modified weights while retaining a familiar label. Conversely, identical model bytes can behave differently under different configuration or context. An integrity finding and a behavioral finding therefore need separate evidence.

Evidence sources

• Model metadata, registry records, deployment manifests, configuration, version history, and access logs.
• Fine-tuning records, data references, adapter settings, lineage assertions, and legitimately acquired weight files.
• Known reference digests, signed distribution records, runtime logs, evaluation inputs, and documented outputs.

Typical investigative questions

• Which identity is directly recorded, and does it refer to a stable version or an alias?
• Can the acquired model bytes be compared with a known, independently obtained reference?
• What fine-tuning or configuration changes were documented?
• Does evidence support tampering, a backdoor hypothesis, or only unexplained behavior?
• Which attribution level remains plausible if deployment records are missing?

Examination methods

Preserve model files and configuration with digests, source details, and acquisition scope. Compare bytes and metadata with a documented reference; validate the reference’s provenance. Map the deployment’s components before attributing behavior to the base model. For behavioral tests, record prompts, context, parameters, tools, versions, and controls.

Investigate suspected tampering or backdoors through a defined hypothesis and reproducible tests. A surprising response is not proof of a malicious modification. Distinguish input-sensitive behavior, configuration effects, and altered model artifacts. Report limitations when weights, training records, or historical deployment state cannot be examined.

Corroborating evidence

A deployment record, signed release, registry entry, and file digest can support a lineage or integrity statement when their sources are trustworthy and their relationships are clear. Vendor identity assertions are useful records but are not independent validation. Correlate service logs and configuration changes with the interval of the investigated interaction.

Common failure modes

• Claiming a named model from writing style, phrasing, or a generated self-identification.
• Treating a matching label as a matching file or deployment.
• Equating byte integrity with the absence of harmful behavior.
• Generalizing one behavioral experiment to every version or configuration.

Limitations

Hosted services may withhold weights and routing details. Model families can share output characteristics, and fine-tuning may alter them. A digest establishes a byte comparison with a reference; it does not establish the training process, authorized ownership, or semantic safety of the model. Unknown historical settings limit replay.

Reporting cautions

State whether attribution is to a file, version label, endpoint, family, or workflow. Name the evidence that supports the association and the alternatives that remain. Avoid guaranteed identification claims. Report tampering as a supported conclusion only when the tested evidence supports that proposition, rather than treating every unexpected response as a backdoor.

Which model configuration produced the response?

Compare accessible deployment records, configuration, runtime versions, weights, and adapters. Preserve identifiers and digests where possible. A stable hosted model label may span changes, so use the request interval and actual revision evidence to describe the supported configuration.

If the provider exposes only a product name, say that the exact underlying state is unavailable. Output style and model self-description can suggest hypotheses, but they do not uniquely identify the historical model.

Related fields & glossary terms

• AI Agent Forensics
• AI Artifact Forensics
• Provenance Forensics

Apply the examination methods, inspect the evidence classes, and check relevant external standards and specifications.