Masego Inc.GEOINT AI Accreditation LedgerMasego Inc.28 rules (illustrative)The rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data. This set is illustrative. · attack list 2026.07MITRE ATLAS: a public catalogue of real-world attacks on AI systems, used here as the list of threats to defend against. · logbook 350 entriesEvery action ever taken in this system, in order. Each entry locks the one before it, so removing or editing one leaves a visible gap. Latest entry fingerprint: b83b7c8492272ad9…

What changed — version 1.3 compared with 1.0

← back to version 1.3

Only what changed since the approved version (1.0) goes back to a reviewer. Here that is 0 of 156 items — 0% of the package, about 0 hours instead of 39. The list below says why each document is or is not reviewed again.
The counts are measured; the minutes per item are an assumption you can change.
0
items to reviewDocuments, rules and attack defences a reviewer has to look at again because something they depend on changed.
156
items if reviewed from scratchEvery document, rule and attack defence in the package — what a full re-review reads.
0%
of the package
0h
instead of 39hAn assumption: how long a reviewer spends on each item. The item counts are measured; this rate is yours to change. Currently 15 minutes per item.

Hours are the item counts, which are measured, times 15 minutes per item, which is an assumption. Change it above and the arithmetic follows.

What changed, and who said so

What the files themselves show changed
nothing
What the submitter said changed
nothing

Some changes leave no trace in the package at all — no file moves when a new attack is published, or when the model is moved to new hosting. Those we only know about because the submitter said so, which is why the two lists are kept apart.

DocumentsThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry.

unchangedThe same file as last time, and still in date. Nobody needs to read it again. 62
DocumentStateWhy
Adversarial test setThe adversarial examples the robustness evaluation was run against.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Analyst workload assessmentEffect of model output volume on the human review capacity behind it.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Anomalous query detectionDetection of query patterns consistent with extraction or probing.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
API access logRecord of queries against the inference interface.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Architecture disclosure reviewWhat published performance and architecture details reveal.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Architecture specModel structure, input and output shapes, and class ontology.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Artifact malware scanScan of serialised artifacts for embedded executable content.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Artifact storage controlsControls protecting weights, corpora, and the package itself at rest.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Availability target (SLO)Availability commitment and its measurement for the inference service.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Backdoor screen resultTesting of the trained model for backdoor behaviour on trigger inputs.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Base model attestationIdentity, source, and content hash of any foundation or pre-trained base.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Base model selection rationaleWhy this base model was chosen, and on what basis it was trusted.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Model checkpoint fingerprintCryptographic hash of the exact weights file under accreditation.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Classification determinationClassification of the model, its weights, and its corpus.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Collection chain attestationIntegrity of the path from sensor to training or inference input.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Corpus classification reviewClassification determination for the corpus and what it reveals.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Corpus disclosure reviewWhat the corpus composition would reveal if disclosed.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Corpus drift monitorContinuous monitoring of corpus composition and label quality over time.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Corpus manifestEnumeration of every dataset in the corpus with content hashes.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Data source attestationOrigin, licence, and rights basis for each corpus source.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Decoy test setImagery of decoys and concealment measures used in that evaluation.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Denial deception assessmentAssessment against known adversary denial and deception practice.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Dependency scanKnown-vulnerability scan across that bill of materials.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Deployment integrity checkVerification that the fielded artifact still matches the accredited hash.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Distribution recordWho holds a copy of the weights, under what agreement.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Downstream dissemination mapWhich products and users receive this model's outputs.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Drift detection recordDetection of distribution shift — new sensors, geographies, seasons.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Extraction evaluationHow much of the model can be reconstructed from its query interface.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
False positive monitorFalse-positive rate in the field, and its trend.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Framework version pinExact pinned versions of training and inference frameworks.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Hardware provenanceProvenance of accelerators and collection hardware in the chain.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Human review procedureWhere a human sits in the chain and what they are accountable for.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Impact assessmentMission consequence of model failure, in the terms the decision is made in.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Inversion evaluationWhat training imagery can be reconstructed from model outputs.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Label provenanceWho or what produced the labels, under what instructions.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Label quality auditSampled re-adjudication of labels against the annotation standard.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Membership inference evaluationWhether an adversary can determine that a given image was in training.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Ontology release reviewReview of what the class ontology reveals. For an overhead detector the ontology approximates a statement of collection priorities.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Operational test recordPerformance in representative operational conditions, not benchmark conditions.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Output disclosure policyWhat the model's outputs may reveal and to whom they may go.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Output granularity reviewWhether output precision leaks more capability than intended.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Package access logRecord of access to the accreditation package itself. The package aggregates everything an adversary would want in one place, which makes it a target in its own right.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Performance monitorFielded performance instrumentation between accreditation events.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Physical attack evaluationPerformance against physically realisable attacks — patches, camouflage, decoys.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Poisoning screen resultScreening of corpus and labels for poisoning indicators.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Provenance of input imageryProvenance chain for imagery the fielded model scores.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Public overlap analysisExtent to which the corpus overlaps publicly available datasets.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Publication review recordPrepublication or export review of programme papers and briefings.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Query rate controlsRate limiting and quota controls on the inference interface.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Releasability determinationForeign-disclosure and releasability posture for the artifact.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Retraining recordWhat was retrained, when, from which baseline, and why.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Retrieval timestampsWhen each external artifact was pulled, pinning it against later substitution.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Robustness evaluationPerformance under adversarially crafted inputs.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Software bill of materials (SBOM)Software bill of materials for the training and serving stack.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Serialisation format recordWeights file format and whether loading executes code.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Synthetic imagery detectionAbility to detect generated or manipulated imagery presented as collection.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Threat model recordStructured threat model mapped to the ATLAS catalogue, with a disposition and mitigation for every in-scope technique. The gated artifact.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Transferability evaluationSuccess rate of attacks developed on a proxy and transferred to this model.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Trigger test setCandidate backdoor triggers the model was tested against.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Vulnerability monitoring recordTracking of newly published attacks against this architecture family.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Weights access logRecord of who accessed model weights and when.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.
Weights provenanceWhere the weights came from, who produced them, and on what run.unchangedThe same file as last time, and still in date. Nobody needs to read it again.Same file, still in date. Not reviewed again.

What does not need reading again

To reviewCarried overUnchanged and still in date since the approved version, so carried over without being read again.
RulesThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data.028
Attack defencesThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk.066

A rule is only carried over when every document under it is unchanged and still in date. Anything else puts it back in front of a reviewer.

What each label means

changedA different file from last time, so somebody has to look.A different file from last time, so somebody has to look.
old modelThe same file, and out of date anyway: something it depended on has changed, so it describes a model that no longer exists. This is the one a plain file comparison misses.The same file, and out of date anyway: something it depended on has changed, so it describes a model that no longer exists. This is the one a plain file comparison misses.
past its dateThe same file, but past the date our policy says it stays good for.The same file, but past the date our policy says it stays good for.
newIt was not in the approved version, so nobody has ever reviewed it.It was not in the approved version, so nobody has ever reviewed it.
goneIt was in the approved version and it is not here.It was in the approved version and it is not here.
unchangedThe same file as last time, and still in date. Nobody needs to read it again.The same file as last time, and still in date. Nobody needs to read it again.