Overhead vehicle detector — version 1.0
← all packages · AccreditedApproved by a named official. The decision is sealed to the exact evidence it rested on. · submitted by ML engineerml.engineer@coe.ic.gov
Decided. Accredited by Accrediting official. The decision is sealed to the exact documents it rested on — the full record is linked below.
28/28
rules metThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data.
66/66
attacks defendedThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk.
62/62
documents in dateThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry.
0
open findingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
Decision checks ⓘThese checks say whether a person is allowed to make a decision — never what the decision should be. Nothing here approves anything.
2 checks block a decision
| Check | Result | What it found |
|---|---|---|
| Open for reviewA decision can only be made on a version somebody has opened for review. | blocks | a decision can only be made on a version under review; this one is 'accredited' |
| Not already decidedDecisions are never changed after the fact. A different decision needs a new version. | blocks | this version has already been decided; decisions are not revised in place |
| Signer is not the submitterWhoever submitted a package may not approve it. Switch who you are acting as to see this change. | OK | Accrediting official is not the submitter |
| No open findingsEvery problem the checks found has been fixed, or accepted as a known risk by a named person with a written reason. | OK | no outstanding findings |
| Evidence in dateEvery document is still inside its validity period on the date being judged. A warning, not a block: out-of-date evidence already blocks through the rules it no longer supports. | OK | all evidence current as of 2026-10-27 |
| Every attack addressedEach AI attack technique that applies to this model has a recorded defence, or a risk somebody has accepted by name. | OK | every attack that applies carries a mitigation or an accepted risk |
| Deployment describedHow the model is deployed decides which rules and attacks apply, so it has to be stated. | OK | 6 deployment condition(s) declared |
| All rules metHow many of the rules and attack defences in scope are established. Shown for information; what actually blocks is the open findings. | OK | 28/28 rules and 66/66 attack defences established |
DecisionThe accrediting official's recorded decision — accredit or reject — and the statement they signed.
Accredited by Accrediting officialaccrediting.official@coe.ic.gov, judged as of 2026-10-24 sealed and intactA fingerprint of exactly what was decided and the evidence it rested on. Edit anything afterwards and the seal no longer matches. Seal 2c7e9748d31673ab6887cd0b…
I certify that I have reviewed this model package and the evidence supporting it, that I am satisfied the accreditation criteria in scope for this deployment are met, and that I am the accrediting official authorised to make this determination. I understand that this determination is mine and was not made by the system, that it rests on the evidence sealed with it, and that it will be relied upon by others.
Wording as signed (2026-09-v2)The exact wording is kept as it was signed. If the standard wording changes later, this record still shows what this person agreed to.
the full decision record — what was decided, on what evidence →
FindingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
Nothing outstanding.
A finding that blocks cannot be waved through. It can be accepted as a known risk — one at a time, by a named person, with a written reason that stays in the record for good. The friction is deliberate.
DocumentsThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry. (62)
| Document | Collected | Valid for | Expires | State | ReleasabilityWho this document may be shared with. It decides what can cross to a partner. |
|---|---|---|---|---|---|
| Adversarial test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Analyst workload assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Anomalous query detection | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| API access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Architecture disclosure review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Architecture spec | 2026-10-21 | no expiry | — | in date | PARTNER-RELEASABLE |
| Artifact malware scan | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Artifact storage controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Availability target (SLO) | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Backdoor screen result | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Base model attestation | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| Base model selection rationale | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Model checkpoint fingerprint | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Classification determination | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Collection chain attestation | 2026-10-21 | 12 months | 2027-10-21 | in date | RESTRICTED |
| Corpus classification review | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Corpus disclosure review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Corpus drift monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Corpus manifest | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Data source attestation | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Decoy test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Denial deception assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Dependency scan | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Deployment integrity check | 2026-10-21 | 1 month | 2026-11-21 | in date | UNCLASSIFIED |
| Distribution record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Downstream dissemination map | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Drift detection record | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Extraction evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| False positive monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Framework version pin | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Hardware provenance | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Human review procedure | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Impact assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Inversion evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Label provenance | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Label quality audit | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Membership inference evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Ontology release review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Operational test record | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Output disclosure policy | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Output granularity review | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Package access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Performance monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Physical attack evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Poisoning screen result | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Provenance of input imagery | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Public overlap analysis | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Publication review record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Query rate controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Releasability determination | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Retraining record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Retrieval timestamps | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Robustness evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Software bill of materials (SBOM) | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| Serialisation format record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Synthetic imagery detection | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Threat model record | 2026-10-21 | 12 months | 2027-10-21 | in date | PARTNER-RELEASABLE |
| Transferability evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Trigger test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Vulnerability monitoring record | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Weights access log | 2026-10-21 | 3 months | 2027-01-21 | in date | RESTRICTED |
| Weights provenance | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
Rules this deployment must meetThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data. (28)
| Rule | What it asks | Status | Missing or out of date |
|---|---|---|---|
| A1 | The artifact under accreditation is uniquely and immutably identified | met | — |
| A2 | The architecture and class ontology are specified | met | — |
| A3 | Inherited weights are attested and pinned | met | — |
| A4 | Loading the artifact does not execute untrusted code | met | — |
| A5 | The software supply chain is inventoried and screened | met | — |
| A6 | The collection and compute chain is attested | met | — |
| B1 | The training corpus is fully enumerated | met | — |
| B2 | The corpus is screened for poisoning and the model for backdoors | met | — |
| B3 | Label quality is independently sampled | met | — |
| B4 | What the corpus reveals has been assessed | met | — |
| C1 | Performance is established under operational conditions | met | — |
| C2 | Fielded performance is instrumented between accreditation events | met | — |
| C3 | The human review capacity behind the model is assessed | met | — |
| D1 | A structured threat model covers every in-scope ATLAS technique | met | — |
| D2 | Robustness against crafted inputs is measured | met | — |
| D3 | Transferred attacks are evaluated even where the model is not exposed | met | — |
| D4 | Physically realisable attacks are evaluated | met | — |
| D5 | Backdoor triggers are tested for | met | — |
| D6 | Interface leakage is quantified | met | — |
| D7 | Synthetic and manipulated input imagery is addressed | met | — |
| E1 | The deployment is described and its conditions declared | met | — |
| E2 | Artifacts and the package itself are protected at rest | met | — |
| E3 | The inference interface is rate-limited and monitored | met | — |
| E4 | The fielded artifact is continuously verified against the accredited baseline | met | — |
| F1 | What the model discloses through its outputs is governed | met | — |
| F2 | Publication and architecture disclosure are reviewed | met | — |
| F3 | Classification and releasability are determined | met | — |
| G1 | Mission impact of model failure is assessed | met | — |
Attacks to defend againstThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk. (66)
| ATLAS IDMITRE ATLAS: a public catalogue of real-world attacks on AI systems, used here as the list of threats to defend against. | Attack technique | Defended? |
|---|---|---|
| AML.T0000 | Search Open Technical Databases | defended |
| AML.T0001 | Search Open AI Vulnerability Analysis | defended |
| AML.T0002 | Acquire Public AI Artifacts | defended |
| AML.T0002.000 | Datasets | defended |
| AML.T0002.001 | Models | defended |
| AML.T0005 | Create Proxy AI Model | defended |
| AML.T0005.000 | Train Proxy via Gathered AI Artifacts | defended |
| AML.T0005.001 | Train Proxy via Replication | defended |
| AML.T0005.002 | Use Pre-Trained Model | defended |
| AML.T0006 | Active Scanning | defended |
| AML.T0007 | Discover AI Artifacts | defended |
| AML.T0010 | AI Supply Chain Compromise | defended |
| AML.T0010.000 | Hardware | defended |
| AML.T0010.001 | AI Software | defended |
| AML.T0010.002 | Data | defended |
| AML.T0010.003 | Model | defended |
| AML.T0011 | User Execution | defended |
| AML.T0011.000 | Unsafe AI Artifacts | defended |
| AML.T0013 | Discover AI Model Ontology | defended |
| AML.T0014 | Discover AI Model Family | defended |
| AML.T0015 | Evade AI Model | defended |
| AML.T0016 | Obtain Capabilities | defended |
| AML.T0016.000 | Adversarial AI Attack Implementations | defended |
| AML.T0017 | Develop Capabilities | defended |
| AML.T0017.000 | Adversarial AI Attacks | defended |
| AML.T0018 | Manipulate AI Model | defended |
| AML.T0018.000 | Poison AI Model | defended |
| AML.T0018.001 | Modify AI Model Architecture | defended |
| AML.T0018.002 | Embed Malware | defended |
| AML.T0020 | Training Data Poisoning | defended |
| AML.T0024 | Exfiltration via AI Inference API | defended |
| AML.T0024.000 | Infer Training Data Membership | defended |
| AML.T0024.001 | Invert AI Model | defended |
| AML.T0024.002 | Extract AI Model | defended |
| AML.T0029 | Denial of AI Service | defended |
| AML.T0031 | Erode AI Model Integrity | defended |
| AML.T0034 | Cost Harvesting | defended |
| AML.T0034.000 | Excessive Queries | defended |
| AML.T0035 | AI Artifact Collection | defended |
| AML.T0040 | AI Model Inference API Access | defended |
| AML.T0041 | Physical Environment Access | defended |
| AML.T0042 | Verify Attack | defended |
| AML.T0043 | Craft Adversarial Data | defended |
| AML.T0043.000 | White-Box Optimization | defended |
| AML.T0043.001 | Black-Box Optimization | defended |
| AML.T0043.002 | Black-Box Transfer | defended |
| AML.T0043.003 | Manual Modification | defended |
| AML.T0043.004 | Insert Backdoor Trigger | defended |
| AML.T0044 | Full AI Model Access | defended |
| AML.T0046 | Spamming AI System with Chaff Data | defended |
| AML.T0047 | AI-Enabled Product or Service | defended |
| AML.T0048 | External Harms | defended |
| AML.T0048.001 | Reputational Harm | defended |
| AML.T0048.002 | Societal Harm | defended |
| AML.T0048.004 | AI Intellectual Property Theft | defended |
| AML.T0059 | Erode Dataset Integrity | defended |
| AML.T0063 | Discover AI Model Outputs | defended |
| AML.T0076 | Corrupt AI Model | defended |
| AML.T0088 | Generate Deepfakes | defended |
| AML.T0096 | AI Service API | defended |
| AML.T0109 | AI Supply Chain Rug Pull | defended |
| AML.T0111 | AI Supply Chain Reputation Inflation | defended |
| AML.T0112.001 | AI Artifacts | defended |
| AML.T0115 | Publish Poisoned AI Artifacts | defended |
| AML.T0115.000 | Datasets | defended |
| AML.T0115.001 | Models | defended |