AI model forensics terminology

Which questions belong in this field?

A deployed AI service can combine a base model, adapters, retrieval, tools, routing, and policy settings. An output therefore need not reflect one isolated model file. Define the component and interval you are attributing before selecting tests.

Training lineage and deployment history are also distinct. A record saying that a service used a particular model version is not a complete account of how that model was trained. Access to weights, configuration, or provider records changes the questions an examiner can answer.

Evidence sources and examination context

Preserve acquired configuration, version identifiers, runtime records, and legitimately obtained model artifacts. Where a byte comparison is possible, document the independently sourced reference and the hash algorithm. The Secure Hash Standard defines digest algorithms; it does not turn a matching label into verified lineage. FIPS 180-4: Secure Hash Standard.

For behavioral attribution, name the candidate set and include a way to reject candidates when the source may lie outside it. Record the input conditions and the evaluation population. A forced-choice result answers which listed candidate scored best, not whether the true source was on the list.

Assess how the evaluation differs from the investigated object. Fine-tuning, changed prompts, domain shift, and service updates can affect transfer. NIST’s AI Risk Management Framework supports documented evaluation and risk assessment; it does not certify model identification. AI Risk Management Framework.

A worked evidence example

Hypothetical example: a response says it came from Model A, while an acquired request record names an endpoint alias. Neither record alone establishes the underlying version. A configuration history that resolves the alias at the relevant time provides a different, more direct association.

A report might identify the recorded endpoint but leave its routed model unresolved. That narrower conclusion is more useful than naming a version from writing style without a tested basis.

What this evidence can and cannot establish

Direct records can support an association with a file, configuration, endpoint, or recorded version. Validated comparisons can narrow candidate sources under stated conditions.

Behavioral similarity does not identify a human author. A digest does not establish training data or safe behavior. Benchmark accuracy does not specify the reliability of a result on every new object, and a confidence score is not automatically a calibrated probability.

Essential terminology

• Model attribution — An assessment linking evidence to a model, version, family, or deployment, with the level and uncertainty made explicit.
• Model lineage — The documented relationships between a model and its predecessors, modifications, adapters, or derived deployments.
• Model provenance — Recorded information about a model’s sources, lineage, modifications, distribution, and deployment history.
• Fine-tuning — Additional training that modifies a model or adaptation component; its records may help establish a deployment’s lineage.
• Benchmark — A specified task, dataset, and evaluation procedure used for comparison.
• Domain shift — A difference between the conditions represented in development or evaluation and those in use.
• Calibration — Agreement between stated confidence or probability estimates and observed outcomes under defined conditions.
• Unknown-source rejection — A method's ability to withhold a known-source classification when the source is outside its supported set.

All 37 terms in this evidence field

• Base model
• Benchmark
• Calibration
• Concept drift
• Confusion matrix
• Data leakage
• Dataset provenance
• Deployment identifier
• Distribution shift
• Domain shift
• Embedding
• Evaluation dataset
• Fine-tuning
• Ground truth
• Hyperparameter
• Inference runtime
• Large language model
• LoRA
• Model adapter
• Model attribution
• Model checkpoint
• Model configuration
• Model forensics
• Model lineage
• Model provenance
• Model version
• Model weights
• Overfitting
• Precision
• Quantization
• Recall
• Receiver operating characteristic
• Sensitivity
• Specificity
• Training data
• Training run
• Unknown-source rejection

Continue with an examination reference

• attribution
• confidence
• attribution
• model forensics

Citation and editorial context

This is an editorial reference. Source checks are separate from independent expert review; no independent reviewer is recorded.

Examples are hypothetical. See the editorial policy, methodology, and correction process.

Shelley, Jesse (ed.). “AI model forensics terminology.” Synthetic Forensics, 1.1.0-glossary-library-1, 2026-10-09. https://syntheticforensics.org/glossary/models/ Accessed: add the date you consulted this page.

The complete vocabulary

Browse the full glossary of 300 terms or download the machine-readable vocabulary.

Field assignment is the project’s organizational taxonomy; related evidence can span several fields.