Overhead vehicle detector — version 1.3
← all packages · what changed → · Under reviewOpened for review. A named official can now accredit or reject it — the system never does. · submitted by ML engineerml.engineer@coe.ic.gov
Ready for a decision. Every check passes — and the system still does nothing on its own. A named official reads the statement below and accredits or rejects.
28/28
rules metThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data.
66/66
attacks defendedThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk.
62/62
documents in dateThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry.
0
open findingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
Decision checks ⓘThese checks say whether a person is allowed to make a decision — never what the decision should be. Nothing here approves anything.
nothing blocking
| Check | Result | What it found |
|---|---|---|
| Open for reviewA decision can only be made on a version somebody has opened for review. | OK | the version is under review |
| Not already decidedDecisions are never changed after the fact. A different decision needs a new version. | OK | no decision has been recorded against this version |
| Signer is not the submitterWhoever submitted a package may not approve it. Switch who you are acting as to see this change. | OK | Accrediting official is not the submitter |
| No open findingsEvery problem the checks found has been fixed, or accepted as a known risk by a named person with a written reason. | OK | no outstanding findings |
| Evidence in dateEvery document is still inside its validity period on the date being judged. A warning, not a block: out-of-date evidence already blocks through the rules it no longer supports. | OK | all evidence current as of 2026-10-27 |
| Every attack addressedEach AI attack technique that applies to this model has a recorded defence, or a risk somebody has accepted by name. | OK | every attack that applies carries a mitigation or an accepted risk |
| Deployment describedHow the model is deployed decides which rules and attacks apply, so it has to be stated. | OK | 6 deployment condition(s) declared |
| All rules metHow many of the rules and attack defences in scope are established. Shown for information; what actually blocks is the open findings. | OK | 28/28 rules and 66/66 attack defences established |
Make the decision
Pressing a button signs the statement above it, in your name. The system records the decision; it never makes it.
I certify that I have reviewed this model package and the evidence supporting it, that I am satisfied the accreditation criteria in scope for this deployment are met, and that I am the accrediting official authorised to make this determination. I understand that this determination is mine and was not made by the system, that it rests on the evidence sealed with it, and that it will be relied upon by others.
I certify that I have reviewed this model package and the evidence supporting it, that I am declining to accredit it, and that I am the accrediting official authorised to make this determination. I understand that this determination is mine and was not made by the system.
Whoever submitted this cannot also sign it off. Switch who you are acting as, above, and watch the checks change.
FindingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
Nothing outstanding.
A finding that blocks cannot be waved through. It can be accepted as a known risk — one at a time, by a named person, with a written reason that stays in the record for good. The friction is deliberate.
DocumentsThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry. (62)
| Document | Collected | Valid for | Expires | State | ReleasabilityWho this document may be shared with. It decides what can cross to a partner. |
|---|---|---|---|---|---|
| Adversarial test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Analyst workload assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Anomalous query detection | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| API access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Architecture disclosure review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Architecture spec | 2026-10-21 | no expiry | — | in date | PARTNER-RELEASABLE |
| Artifact malware scan | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Artifact storage controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Availability target (SLO) | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Backdoor screen result | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Base model attestation | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| Base model selection rationale | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Model checkpoint fingerprint | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Classification determination | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Collection chain attestation | 2026-10-21 | 12 months | 2027-10-21 | in date | RESTRICTED |
| Corpus classification review | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Corpus disclosure review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Corpus drift monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Corpus manifest | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Data source attestation | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Decoy test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Denial deception assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Dependency scan | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Deployment integrity check | 2026-10-21 | 1 month | 2026-11-21 | in date | UNCLASSIFIED |
| Distribution record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Downstream dissemination map | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Drift detection record | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Extraction evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| False positive monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Framework version pin | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Hardware provenance | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Human review procedure | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Impact assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Inversion evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Label provenance | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Label quality audit | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Membership inference evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Ontology release review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Operational test record | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Output disclosure policy | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Output granularity review | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Package access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Performance monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Physical attack evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Poisoning screen result | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Provenance of input imagery | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Public overlap analysis | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Publication review record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Query rate controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Releasability determination | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Retraining record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Retrieval timestamps | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Robustness evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Software bill of materials (SBOM) | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| Serialisation format record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Synthetic imagery detection | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Threat model record | 2026-10-21 | 12 months | 2027-10-21 | in date | PARTNER-RELEASABLE |
| Transferability evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Trigger test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Vulnerability monitoring record | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Weights access log | 2026-10-21 | 3 months | 2027-01-21 | in date | RESTRICTED |
| Weights provenance | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
Rules this deployment must meetThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data. (28)
| Rule | What it asks | Status | Missing or out of date |
|---|---|---|---|
| A1 | The artifact under accreditation is uniquely and immutably identified | metcarried forward | — |
| A2 | The architecture and class ontology are specified | metcarried forward | — |
| A3 | Inherited weights are attested and pinned | metcarried forward | — |
| A4 | Loading the artifact does not execute untrusted code | metcarried forward | — |
| A5 | The software supply chain is inventoried and screened | metcarried forward | — |
| A6 | The collection and compute chain is attested | metcarried forward | — |
| B1 | The training corpus is fully enumerated | metcarried forward | — |
| B2 | The corpus is screened for poisoning and the model for backdoors | metcarried forward | — |
| B3 | Label quality is independently sampled | metcarried forward | — |
| B4 | What the corpus reveals has been assessed | metcarried forward | — |
| C1 | Performance is established under operational conditions | metcarried forward | — |
| C2 | Fielded performance is instrumented between accreditation events | metcarried forward | — |
| C3 | The human review capacity behind the model is assessed | metcarried forward | — |
| D1 | A structured threat model covers every in-scope ATLAS technique | metcarried forward | — |
| D2 | Robustness against crafted inputs is measured | metcarried forward | — |
| D3 | Transferred attacks are evaluated even where the model is not exposed | metcarried forward | — |
| D4 | Physically realisable attacks are evaluated | metcarried forward | — |
| D5 | Backdoor triggers are tested for | metcarried forward | — |
| D6 | Interface leakage is quantified | metcarried forward | — |
| D7 | Synthetic and manipulated input imagery is addressed | metcarried forward | — |
| E1 | The deployment is described and its conditions declared | metcarried forward | — |
| E2 | Artifacts and the package itself are protected at rest | metcarried forward | — |
| E3 | The inference interface is rate-limited and monitored | metcarried forward | — |
| E4 | The fielded artifact is continuously verified against the accredited baseline | metcarried forward | — |
| F1 | What the model discloses through its outputs is governed | metcarried forward | — |
| F2 | Publication and architecture disclosure are reviewed | metcarried forward | — |
| F3 | Classification and releasability are determined | metcarried forward | — |
| G1 | Mission impact of model failure is assessed | metcarried forward | — |
Attacks to defend againstThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk. (66)
| ATLAS IDMITRE ATLAS: a public catalogue of real-world attacks on AI systems, used here as the list of threats to defend against. | Attack technique | Defended? |
|---|---|---|
| AML.T0000 | Search Open Technical Databases | defended |
| AML.T0001 | Search Open AI Vulnerability Analysis | defended |
| AML.T0002 | Acquire Public AI Artifacts | defended |
| AML.T0002.000 | Datasets | defended |
| AML.T0002.001 | Models | defended |
| AML.T0005 | Create Proxy AI Model | defended |
| AML.T0005.000 | Train Proxy via Gathered AI Artifacts | defended |
| AML.T0005.001 | Train Proxy via Replication | defended |
| AML.T0005.002 | Use Pre-Trained Model | defended |
| AML.T0006 | Active Scanning | defended |
| AML.T0007 | Discover AI Artifacts | defended |
| AML.T0010 | AI Supply Chain Compromise | defended |
| AML.T0010.000 | Hardware | defended |
| AML.T0010.001 | AI Software | defended |
| AML.T0010.002 | Data | defended |
| AML.T0010.003 | Model | defended |
| AML.T0011 | User Execution | defended |
| AML.T0011.000 | Unsafe AI Artifacts | defended |
| AML.T0013 | Discover AI Model Ontology | defended |
| AML.T0014 | Discover AI Model Family | defended |
| AML.T0015 | Evade AI Model | defended |
| AML.T0016 | Obtain Capabilities | defended |
| AML.T0016.000 | Adversarial AI Attack Implementations | defended |
| AML.T0017 | Develop Capabilities | defended |
| AML.T0017.000 | Adversarial AI Attacks | defended |
| AML.T0018 | Manipulate AI Model | defended |
| AML.T0018.000 | Poison AI Model | defended |
| AML.T0018.001 | Modify AI Model Architecture | defended |
| AML.T0018.002 | Embed Malware | defended |
| AML.T0020 | Training Data Poisoning | defended |
| AML.T0024 | Exfiltration via AI Inference API | defended |
| AML.T0024.000 | Infer Training Data Membership | defended |
| AML.T0024.001 | Invert AI Model | defended |
| AML.T0024.002 | Extract AI Model | defended |
| AML.T0029 | Denial of AI Service | defended |
| AML.T0031 | Erode AI Model Integrity | defended |
| AML.T0034 | Cost Harvesting | defended |
| AML.T0034.000 | Excessive Queries | defended |
| AML.T0035 | AI Artifact Collection | defended |
| AML.T0040 | AI Model Inference API Access | defended |
| AML.T0041 | Physical Environment Access | defended |
| AML.T0042 | Verify Attack | defended |
| AML.T0043 | Craft Adversarial Data | defended |
| AML.T0043.000 | White-Box Optimization | defended |
| AML.T0043.001 | Black-Box Optimization | defended |
| AML.T0043.002 | Black-Box Transfer | defended |
| AML.T0043.003 | Manual Modification | defended |
| AML.T0043.004 | Insert Backdoor Trigger | defended |
| AML.T0044 | Full AI Model Access | defended |
| AML.T0046 | Spamming AI System with Chaff Data | defended |
| AML.T0047 | AI-Enabled Product or Service | defended |
| AML.T0048 | External Harms | defended |
| AML.T0048.001 | Reputational Harm | defended |
| AML.T0048.002 | Societal Harm | defended |
| AML.T0048.004 | AI Intellectual Property Theft | defended |
| AML.T0059 | Erode Dataset Integrity | defended |
| AML.T0063 | Discover AI Model Outputs | defended |
| AML.T0076 | Corrupt AI Model | defended |
| AML.T0088 | Generate Deepfakes | defended |
| AML.T0096 | AI Service API | defended |
| AML.T0109 | AI Supply Chain Rug Pull | defended |
| AML.T0111 | AI Supply Chain Reputation Inflation | defended |
| AML.T0112.001 | AI Artifacts | defended |
| AML.T0115 | Publish Poisoned AI Artifacts | defended |
| AML.T0115.000 | Datasets | defended |
| AML.T0115.001 | Models | defended |