Decision record — Overhead vehicle detector, version 1.0
← back to the version · tamper check
The page somebody asks for years later: what was decided, by whom, on what date, and on exactly which documents. Every figure here is taken from the sealedA fingerprint of exactly what was decided and the evidence it rested on. Edit anything afterwards and the seal no longer matches. record, not from today’s data — and if anything has been changed since, it is listed under What has changed since.
What was signed
I certify that I have reviewed this model package and the evidence supporting it, that I am satisfied the accreditation criteria in scope for this deployment are met, and that I am the accrediting official authorised to make this determination. I understand that this determination is mine and was not made by the system, that it rests on the evidence sealed with it, and that it will be relied upon by others.
Wording as signed (2026-09-v2). A record keeps the wording it was signed under, so this is what accrediting official agreed to — not whatever the standard wording says today.
The documentsThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry. it rested on (62)
| Document | FingerprintA short code computed from a file's exact contents. Change a single character and the code changes completely. | Collected | Good until | At the time | ReleasabilityWho this document may be shared with. It decides what can cross to a partner. |
|---|---|---|---|---|---|
| Adversarial test setThe adversarial examples the robustness evaluation was run against. | 195a0cacf148…195a0cacf1482156ed81e5de85d7d40c4cd6a08ec5c05bed2a44e1ee9cc03832 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Analyst workload assessmentEffect of model output volume on the human review capacity behind it. | 2ee30cb1ce9e…2ee30cb1ce9e41ae44ff37c1e805a303beceaea2269741e6f06cba8b0b652569 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Anomalous query detectionDetection of query patterns consistent with extraction or probing. | 32e34f3a91c0…32e34f3a91c0f225e79f07d781712cf095b296a1b08d1180907ebb5e8aaf53fe | 2026-10-21 | 2027-04-21 | in date | UNCLASSIFIED |
| API access logRecord of queries against the inference interface. | 61f36842b98d…61f36842b98d202496cb6e2185135030a947cf5685a618ac66da1700f86a78bd | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Architecture disclosure reviewWhat published performance and architecture details reveal. | 86d73325f6f0…86d73325f6f02d890b6c796550e107b82a27d5a75172f6ec4e8cf40d179b7d8a | 2026-10-21 | 2028-10-21 | in date | UNCLASSIFIED |
| Architecture specModel structure, input and output shapes, and class ontology. | 4d09147ae316…4d09147ae31650daf4b9608b02ffe437285fe134dd8b0705d9da0a71e3f9f469 | 2026-10-21 | no expiry | in date | PARTNER-RELEASABLE |
| Artifact malware scanScan of serialised artifacts for embedded executable content. | baa3ac5aa1ea…baa3ac5aa1ea28c661d0f30c708fb83e13c4010f852ade73610b3c7142f88c09 | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Artifact storage controlsControls protecting weights, corpora, and the package itself at rest. | c5b40ca8d61d…c5b40ca8d61da97afce44877ec75a7ba87b0b4844d5d95cc2432bfa16d379123 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Availability target (SLO)Availability commitment and its measurement for the inference service. | 384b645135b1…384b645135b13ad87f2b95fbc58f78a2ec87d735806b520c706e416e136a6d65 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Backdoor screen resultTesting of the trained model for backdoor behaviour on trigger inputs. | 50a7aa669ff3…50a7aa669ff3d8d26b52fde4a31536a9d3aa8996b7e18f07c1369376935f00cd | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Base model attestationIdentity, source, and content hash of any foundation or pre-trained base. | 68957459adb3…68957459adb3348019ee6cead262e2906dc24002c862b66989e2ca816eb60dce | 2026-10-21 | 2027-04-21 | in date | UNCLASSIFIED |
| Base model selection rationaleWhy this base model was chosen, and on what basis it was trusted. | 6db8d31a5f9c…6db8d31a5f9c828cbf553de0e7444ba688020497089338d29b3254401dfc6703 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Model checkpoint fingerprintCryptographic hash of the exact weights file under accreditation. | 57ae061dd732…57ae061dd73209fb7980d5a31718a264b9b0616d1744fbe407c635763fa69b14 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Classification determinationClassification of the model, its weights, and its corpus. | b8dc7683c198…b8dc7683c198bbf0f13375556bf125f500c10307099fec47b5fd3615a6257048 | 2026-10-21 | 2028-10-21 | in date | RESTRICTED |
| Collection chain attestationIntegrity of the path from sensor to training or inference input. | eec767467bee…eec767467beef701d1532aff914bd1ecdbd668a8e30083c38acf903fab6d771c | 2026-10-21 | 2027-10-21 | in date | RESTRICTED |
| Corpus classification reviewClassification determination for the corpus and what it reveals. | 5fedba8abb9a…5fedba8abb9af97b731e31e62f72334b95e3b5ddbb4a3096b8867f1019c89f05 | 2026-10-21 | 2028-10-21 | in date | RESTRICTED |
| Corpus disclosure reviewWhat the corpus composition would reveal if disclosed. | 51b94a824101…51b94a824101391677d7d409f86498c0fc2c3993799087a8c6799a773aa570ed | 2026-10-21 | 2028-10-21 | in date | UNCLASSIFIED |
| Corpus drift monitorContinuous monitoring of corpus composition and label quality over time. | 0efd42980e03…0efd42980e030b146ebc6a33c4175d82d3a80168b0db3bf9a1fe9106289c834a | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Corpus manifestEnumeration of every dataset in the corpus with content hashes. | 9277816b24b3…9277816b24b3ae732e1ba629bdbdf7a6da8c734ca9bb63c58aa7e08d7e957578 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Data source attestationOrigin, licence, and rights basis for each corpus source. | 04c0f9813326…04c0f98133262b2b0b8594483406bf1e25186f127761a5ed6b85326b0334d1c6 | 2026-10-21 | 2028-10-21 | in date | UNCLASSIFIED |
| Decoy test setImagery of decoys and concealment measures used in that evaluation. | a60d724be64a…a60d724be64a3b90bcf0f53cf69133c408d992a509a3a2740fc3a403d24e9c6d | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Denial deception assessmentAssessment against known adversary denial and deception practice. | b1053b717408…b1053b717408f8a0085ff1fbea317d89eabd81644998b60f71a53b8948658f7c | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Dependency scanKnown-vulnerability scan across that bill of materials. | 1f30e01bacfa…1f30e01bacfa32d0fe286b6b1aa9af7ff5da0d9ff7e09ba0af623648b311e44b | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Deployment integrity checkVerification that the fielded artifact still matches the accredited hash. | ba0001d0270f…ba0001d0270f478a9e1987576520bf271538bd973896dd31109575fcb3dbf3da | 2026-10-21 | 2026-11-21 | in date | UNCLASSIFIED |
| Distribution recordWho holds a copy of the weights, under what agreement. | 08e2a4288c96…08e2a4288c96573e5394e2017224086737e28c942f58b3d1f321dfb449702265 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Downstream dissemination mapWhich products and users receive this model's outputs. | 3e30aeb7a3c4…3e30aeb7a3c49a994aed9c99bf99ae350229cf4488b1abec2d28042c3da5dc3c | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Drift detection recordDetection of distribution shift — new sensors, geographies, seasons. | fd0e882bab4a…fd0e882bab4af49d8a94c597a143701719b9f8739cc08d9127b7839acf1560de | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Extraction evaluationHow much of the model can be reconstructed from its query interface. | 42b22636d803…42b22636d80311c7284245199e3469e1467a0d45d0b38ec51f6b348613dd599e | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| False positive monitorFalse-positive rate in the field, and its trend. | 5e443a340326…5e443a3403266c18234229b58720e26c5b967c1814d69dad9fa550a2112436ad | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Framework version pinExact pinned versions of training and inference frameworks. | db4aad81a449…db4aad81a449969425e0984154a7f4cd6001a965971e81968414644fee81f132 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Hardware provenanceProvenance of accelerators and collection hardware in the chain. | f8194eff9e43…f8194eff9e43affd1027c22d3757126f97d48c8f12ec0980355402a7f951426c | 2026-10-21 | 2028-10-21 | in date | UNCLASSIFIED |
| Human review procedureWhere a human sits in the chain and what they are accountable for. | 2baed6462055…2baed646205563746bf51f28812c9c12be830a5810c45a2237486be2d53554dd | 2026-10-21 | 2028-10-21 | in date | UNCLASSIFIED |
| Impact assessmentMission consequence of model failure, in the terms the decision is made in. | 81121adff7c7…81121adff7c7cb2d51131aa18bd2ccbdde760ba97441e08bf21a73a34b59156c | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Inversion evaluationWhat training imagery can be reconstructed from model outputs. | beba43dd58ac…beba43dd58ac02076bd4d2d9581652d826b55e48af38d4c8802bac4b66590912 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Label provenanceWho or what produced the labels, under what instructions. | 838d81f33169…838d81f3316901f409ce5f9a9c2272631f976f5fa1833c4e76daaff47b510bd5 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Label quality auditSampled re-adjudication of labels against the annotation standard. | 65484c333615…65484c33361566d83e8d03e0d9b9e2054a9009c25c875ceffec7868e016f555f | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Membership inference evaluationWhether an adversary can determine that a given image was in training. | f1cb61471fa9…f1cb61471fa9521e89924da5daad9d9809a2961b3e838c4c22bc87028a23a755 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Ontology release reviewReview of what the class ontology reveals. For an overhead detector the ontology approximates a statement of collection priorities. | b74696996599…b746969965998948c13b4fab85e30294dea1308fa2e860fc1fa0301ce568e8d7 | 2026-10-21 | 2028-10-21 | in date | UNCLASSIFIED |
| Operational test recordPerformance in representative operational conditions, not benchmark conditions. | 8e07bf523c3b…8e07bf523c3b9365699021f720d2630a067609b31a52337a44d1acd961aaacbe | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Output disclosure policyWhat the model's outputs may reveal and to whom they may go. | 679432be203a…679432be203acfc8b3546890e24651c81382f491bfbc56031ce125bd01549ddb | 2026-10-21 | 2028-10-21 | in date | UNCLASSIFIED |
| Output granularity reviewWhether output precision leaks more capability than intended. | 59b956958f8b…59b956958f8b576e69448bffc6fca0a3b280a2980bbf78b1d86262c0fa5086b5 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Package access logRecord of access to the accreditation package itself. The package aggregates everything an adversary would want in one place, which makes it a target in its own right. | 25f1df8e5f06…25f1df8e5f06d222f82478816ec941c138682daabfa751cf50db82428d4d748b | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Performance monitorFielded performance instrumentation between accreditation events. | d08176b90fe9…d08176b90fe9e56e416f2961a0566e1a0c3431d1da5ee0cca96449e11b6e85bd | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Physical attack evaluationPerformance against physically realisable attacks — patches, camouflage, decoys. | dac02a54f4ee…dac02a54f4ee418f90b25eca5f7529fe95a56b13b6d48010c8288da2fb990bd7 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Poisoning screen resultScreening of corpus and labels for poisoning indicators. | d624f442aa42…d624f442aa42c2c27345f70c4c52990b1ee016224b7a3a5a636bbcffb44625a7 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Provenance of input imageryProvenance chain for imagery the fielded model scores. | 2eb86f8fe1fa…2eb86f8fe1fa199559639a8c398dc176b2a2a0ca577ab1ffe7669cab87d7072b | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Public overlap analysisExtent to which the corpus overlaps publicly available datasets. | bbfb60e69ace…bbfb60e69ace1abc559cabf9ad4cb8bfb2387f472c9bb4aa60f0b3797ea62e07 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Publication review recordPrepublication or export review of programme papers and briefings. | 5d14d5b331ea…5d14d5b331ead5df7a5fa66f2d5262f94c73a686db62aad2542113b385a82293 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Query rate controlsRate limiting and quota controls on the inference interface. | 1acfc4e30e7a…1acfc4e30e7a33c903f902cab65c8681b47f813fccc516af8c99543b174979c2 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Releasability determinationForeign-disclosure and releasability posture for the artifact. | 7a926a9e8b88…7a926a9e8b88d940dcd42e6be17eca840f18b1fbf0287b30a65887c11a9ad1e2 | 2026-10-21 | 2028-10-21 | in date | RESTRICTED |
| Retraining recordWhat was retrained, when, from which baseline, and why. | 922486684af1…922486684af19d377171a41cd31029f6681691356ad880d458a0abcd79407c75 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Retrieval timestampsWhen each external artifact was pulled, pinning it against later substitution. | 724950aee37b…724950aee37bd3bd82844f4fa4a26dd955b00129a7ba1115ccfc97299128b44c | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Robustness evaluationPerformance under adversarially crafted inputs. | c3a7bb2e0af6…c3a7bb2e0af6be54f69441f8b4b206c2c7d20082ce2c024b60a6d15199d8f74a | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Software bill of materials (SBOM)Software bill of materials for the training and serving stack. | a76c10f5d4e2…a76c10f5d4e25c1e9ecdb192528e2fa7cb2e1dd93813246c37c0730c17d3495f | 2026-10-21 | 2027-04-21 | in date | UNCLASSIFIED |
| Serialisation format recordWeights file format and whether loading executes code. | 07c061e49888…07c061e4988868dc81e7e3405ca53a05c8eccf7cf77d2ae4dd16c7de69fd074b | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
| Synthetic imagery detectionAbility to detect generated or manipulated imagery presented as collection. | e439e1b9dbee…e439e1b9dbeeeda90266708d2d8afda6c5ca1aa2ab277b20e5b2479d2948e961 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Threat model recordStructured threat model mapped to the ATLAS catalogue, with a disposition and mitigation for every in-scope technique. The gated artifact. | b8e89f2cb5ba…b8e89f2cb5ba32399e94fe293efc1671e0d49543b4c6456aaeaed743112158af | 2026-10-21 | 2027-10-21 | in date | PARTNER-RELEASABLE |
| Transferability evaluationSuccess rate of attacks developed on a proxy and transferred to this model. | 7d9b299aa778…7d9b299aa778b4b46a13ca46ab43fcfcc8cb5ba66a9046f8252e06d95410164a | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Trigger test setCandidate backdoor triggers the model was tested against. | d8b95cd02b60…d8b95cd02b6017b092fa6127449691f3d8e2daf4cb5b0843e3437c22e0cfe959 | 2026-10-21 | 2027-10-21 | in date | UNCLASSIFIED |
| Vulnerability monitoring recordTracking of newly published attacks against this architecture family. | 2de02ecea310…2de02ecea31063afa4a7490d5554ff90842f024763e2b45147fd168d59eae1cb | 2026-10-21 | 2027-01-21 | in date | UNCLASSIFIED |
| Weights access logRecord of who accessed model weights and when. | 49012b2610f4…49012b2610f4ea5a79240589db3ff38a8c6f9ba1a2440e51bb690ca1cab960d0 | 2026-10-21 | 2027-01-21 | in date | RESTRICTED |
| Weights provenanceWhere the weights came from, who produced them, and on what run. | 9b1529953c8f…9b1529953c8f36b18e5d6dff5c77547d10a2a011f7bb0643aa05dcb63f38c3d9 | 2026-10-21 | no expiry | in date | UNCLASSIFIED |
These fingerprints are what make the rest of this page checkable: any of these files can be fingerprinted again today and compared with the value sealed here.
What it met
28/28
rules metThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data.
66/66
attacks answeredThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk.
0
risks accepted by nameA known problem somebody has chosen to accept, one at a time, with a written reason that stays in the record permanently.
0
reused from an allied partnerReusing an allied partner's accreditation for the parts their framework and ours agree on, instead of repeating that work.
| Rule | What it asks | As sealed |
|---|---|---|
| A1 | The artifact under accreditation is uniquely and immutably identified | met |
| A2 | The architecture and class ontology are specified | met |
| A3 | Inherited weights are attested and pinned | met |
| A4 | Loading the artifact does not execute untrusted code | met |
| A5 | The software supply chain is inventoried and screened | met |
| A6 | The collection and compute chain is attested | met |
| B1 | The training corpus is fully enumerated | met |
| B2 | The corpus is screened for poisoning and the model for backdoors | met |
| B3 | Label quality is independently sampled | met |
| B4 | What the corpus reveals has been assessed | met |
| C1 | Performance is established under operational conditions | met |
| C2 | Fielded performance is instrumented between accreditation events | met |
| C3 | The human review capacity behind the model is assessed | met |
| D1 | A structured threat model covers every in-scope ATLAS technique | met |
| D2 | Robustness against crafted inputs is measured | met |
| D3 | Transferred attacks are evaluated even where the model is not exposed | met |
| D4 | Physically realisable attacks are evaluated | met |
| D5 | Backdoor triggers are tested for | met |
| D6 | Interface leakage is quantified | met |
| D7 | Synthetic and manipulated input imagery is addressed | met |
| E1 | The deployment is described and its conditions declared | met |
| E2 | Artifacts and the package itself are protected at rest | met |
| E3 | The inference interface is rate-limited and monitored | met |
| E4 | The fielded artifact is continuously verified against the accredited baseline | met |
| F1 | What the model discloses through its outputs is governed | met |
| F2 | Publication and architecture disclosure are reviewed | met |
| F3 | Classification and releasability are determined | met |
| G1 | Mission impact of model failure is assessed | met |
How it got here (66 logbook entries) ⓘEvery action ever taken in this system, in order. Each entry locks the one before it, so removing or editing one leaves a visible gap.
| # | What happened | Who | When |
|---|---|---|---|
| 2 | Version started | submitter | 2026-10-26 17:22:54 |
| 3–64 | 62 × Document added | ML engineer | 2026-10-26 17:22:54 |
| 65 | Version submitted | ML engineer | 2026-10-26 17:22:54 |
| 66 | Review opened | Accrediting official | 2026-10-26 17:22:54 |
| 67 | Decision recorded | Accrediting official | 2026-10-26 17:22:54 |
Repeated identical entries are shown as one row with a count — sixty-two lines saying “document added” in the same second is noise, not history. Every entry is still individually present in the record and individually locked into the logbook.
Assessed against the illustrative rule set illustrative-geoint-ai-v0 and the MITRE ATLAS 2026.07 attack list. How it is deployed: Answers queries from outside the enclave; An LLM or AI agent is in the chain; Copies go beyond our organisation; Built on a pre-trained model; Adversary can influence collection; Uses training data from outside. Changes declared since the approved version: none.
This page is the record, not a report about it. Print it and the paper copy carries the same fingerprints — or take the machine-readable version from /api/versions/927a8d6262a34dff8cb9e3ded7f1f843/determination, which is what this page is rendered from.