Overhead vehicle detector — version 1.1
← all packages · what changed → · SubmittedSent in and frozen. Nobody has opened it for review yet. · submitted by ML engineerml.engineer@coe.ic.gov
Next step: open the review. The checks below show what a reviewer will find. Opening the review is recorded as its own step; the decision comes after.
14/28
rules metThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data.
29/66
attacks defendedThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk.
38/62
documents in dateThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry.
51
open findingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
Decision checks ⓘThese checks say whether a person is allowed to make a decision — never what the decision should be. Nothing here approves anything.
2 checks block a decision
| Check | Result | What it found |
|---|---|---|
| Open for reviewA decision can only be made on a version somebody has opened for review. | blocks | a decision can only be made on a version under review; this one is 'submitted' |
| Not already decidedDecisions are never changed after the fact. A different decision needs a new version. | OK | no decision has been recorded against this version |
| Signer is not the submitterWhoever submitted a package may not approve it. Switch who you are acting as to see this change. | OK | Accrediting official is not the submitter |
| No open findingsEvery problem the checks found has been fixed, or accepted as a known risk by a named person with a written reason. | blocks | 51 finding(s) neither resolved nor accepted as risk: A1, A3, A4, AML.T0001, AML.T0002, AML.T0002.000… |
| Evidence in dateEvery document is still inside its validity period on the date being judged. A warning, not a block: out-of-date evidence already blocks through the rules it no longer supports. | warning | 24 document(s) not current as of 2026-10-27: artifact malware scan, backdoor screen result, base model attestation, base model selection rationale, classification determination, corpus classification review… |
| Every attack addressedEach AI attack technique that applies to this model has a recorded defence, or a risk somebody has accepted by name. | OK | every attack that applies carries a mitigation or an accepted risk |
| Deployment describedHow the model is deployed decides which rules and attacks apply, so it has to be stated. | OK | 6 deployment condition(s) declared |
| All rules metHow many of the rules and attack defences in scope are established. Shown for information; what actually blocks is the open findings. | warning | 14/28 rules and 29/66 attack defences established |
FindingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
ruleA11 document(s) missing or out of date
ruleA33 document(s) missing or out of date
ruleA42 document(s) missing or out of date
attackAML.T0001Search Open AI Vulnerability Analysis — 1 document(s) missing or out of date
attackAML.T0002Acquire Public AI Artifacts — 1 document(s) missing or out of date
attackAML.T0002.000Datasets — 1 document(s) missing or out of date
attackAML.T0002.001Models — 1 document(s) missing or out of date
attackAML.T0005Create Proxy AI Model — 1 document(s) missing or out of date
attackAML.T0005.000Train Proxy via Gathered AI Artifacts — 2 document(s) missing or out of date
attackAML.T0005.002Use Pre-Trained Model — 2 document(s) missing or out of date
attackAML.T0010.003Model — 1 document(s) missing or out of date
attackAML.T0011User Execution — 2 document(s) missing or out of date
attackAML.T0011.000Unsafe AI Artifacts — 2 document(s) missing or out of date
attackAML.T0015Evade AI Model — 2 document(s) missing or out of date
attackAML.T0016Obtain Capabilities — 1 document(s) missing or out of date
attackAML.T0016.000Adversarial AI Attack Implementations — 2 document(s) missing or out of date
attackAML.T0017Develop Capabilities — 1 document(s) missing or out of date
attackAML.T0017.000Adversarial AI Attacks — 2 document(s) missing or out of date
attackAML.T0018Manipulate AI Model — 1 document(s) missing or out of date
attackAML.T0018.000Poison AI Model — 1 document(s) missing or out of date
attackAML.T0018.002Embed Malware — 2 document(s) missing or out of date
attackAML.T0020Training Data Poisoning — 1 document(s) missing or out of date
attackAML.T0024.000Infer Training Data Membership — 2 document(s) missing or out of date
attackAML.T0024.001Invert AI Model — 2 document(s) missing or out of date
attackAML.T0024.002Extract AI Model — 1 document(s) missing or out of date
attackAML.T0041Physical Environment Access — 1 document(s) missing or out of date
attackAML.T0043Craft Adversarial Data — 2 document(s) missing or out of date
attackAML.T0043.002Black-Box Transfer — 1 document(s) missing or out of date
attackAML.T0043.003Manual Modification — 1 document(s) missing or out of date
attackAML.T0043.004Insert Backdoor Trigger — 1 document(s) missing or out of date
attackAML.T0044Full AI Model Access — 1 document(s) missing or out of date
attackAML.T0048External Harms — 1 document(s) missing or out of date
attackAML.T0048.004AI Intellectual Property Theft — 2 document(s) missing or out of date
attackAML.T0059Erode Dataset Integrity — 2 document(s) missing or out of date
attackAML.T0076Corrupt AI Model — 1 document(s) missing or out of date
attackAML.T0109AI Supply Chain Rug Pull — 2 document(s) missing or out of date
attackAML.T0111AI Supply Chain Reputation Inflation — 1 document(s) missing or out of date
attackAML.T0115Publish Poisoned AI Artifacts — 1 document(s) missing or out of date
attackAML.T0115.000Datasets — 1 document(s) missing or out of date
attackAML.T0115.001Models — 2 document(s) missing or out of date
ruleB23 document(s) missing or out of date
ruleB32 document(s) missing or out of date
ruleB42 document(s) missing or out of date
ruleC11 document(s) missing or out of date
ruleD11 document(s) missing or out of date
ruleD21 document(s) missing or out of date
ruleD31 document(s) missing or out of date
ruleD41 document(s) missing or out of date
ruleD63 document(s) missing or out of date
ruleE41 document(s) missing or out of date
ruleF32 document(s) missing or out of date
A finding that blocks cannot be waved through. It can be accepted as a known risk — one at a time, by a named person, with a written reason that stays in the record for good. The friction is deliberate.
DocumentsThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry. (62)
| Document | Collected | Valid for | Expires | State | ReleasabilityWho this document may be shared with. It decides what can cross to a partner. |
|---|---|---|---|---|---|
| Adversarial test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Analyst workload assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Anomalous query detection | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| API access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Architecture disclosure review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Architecture spec | 2026-10-21 | no expiry | — | in date | PARTNER-RELEASABLE |
| Artifact malware scan | 2026-10-21 | 3 months | 2027-01-21 | old model | UNCLASSIFIED |
| Artifact storage controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Availability target (SLO) | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Backdoor screen result | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Base model attestation | 2026-10-21 | 6 months | 2027-04-21 | old model | UNCLASSIFIED |
| Base model selection rationale | 2026-10-21 | no expiry | — | old model | UNCLASSIFIED |
| Model checkpoint fingerprint | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Classification determination | 2026-10-21 | 24 months | 2028-10-21 | old model | RESTRICTED |
| Collection chain attestation | 2026-10-21 | 12 months | 2027-10-21 | in date | RESTRICTED |
| Corpus classification review | 2026-10-21 | 24 months | 2028-10-21 | old model | RESTRICTED |
| Corpus disclosure review | 2026-10-21 | 24 months | 2028-10-21 | old model | UNCLASSIFIED |
| Corpus drift monitor | 2026-10-21 | 3 months | 2027-01-21 | old model | UNCLASSIFIED |
| Corpus manifest | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Data source attestation | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Decoy test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Denial deception assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Dependency scan | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Deployment integrity check | 2026-10-21 | 1 month | 2026-11-21 | old model | UNCLASSIFIED |
| Distribution record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Downstream dissemination map | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Drift detection record | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Extraction evaluation | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| False positive monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Framework version pin | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Hardware provenance | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Human review procedure | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Impact assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Inversion evaluation | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Label provenance | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Label quality audit | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Membership inference evaluation | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Ontology release review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Operational test record | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Output disclosure policy | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Output granularity review | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Package access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Performance monitor | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Physical attack evaluation | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Poisoning screen result | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Provenance of input imagery | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Public overlap analysis | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Publication review record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Query rate controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Releasability determination | 2026-10-21 | 24 months | 2028-10-21 | old model | RESTRICTED |
| Retraining record | 2026-10-21 | no expiry | — | old model | UNCLASSIFIED |
| Retrieval timestamps | 2026-10-21 | no expiry | — | old model | UNCLASSIFIED |
| Robustness evaluation | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Software bill of materials (SBOM) | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| Serialisation format record | 2026-10-21 | no expiry | — | old model | UNCLASSIFIED |
| Synthetic imagery detection | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Threat model record | 2026-10-21 | 12 months | 2027-10-21 | old model | PARTNER-RELEASABLE |
| Transferability evaluation | 2026-10-21 | 12 months | 2027-10-21 | old model | UNCLASSIFIED |
| Trigger test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Vulnerability monitoring record | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Weights access log | 2026-10-21 | 3 months | 2027-01-21 | in date | RESTRICTED |
| Weights provenance | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
Rules this deployment must meetThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data. (28)
| Rule | What it asks | Status | Missing or out of date |
|---|---|---|---|
| A1 | The artifact under accreditation is uniquely and immutably identified | not met | Retraining record |
| A2 | The architecture and class ontology are specified | metcarried forward | — |
| A3 | Inherited weights are attested and pinned | not met | Base model attestation, Base model selection rationale, Retrieval timestamps |
| A4 | Loading the artifact does not execute untrusted code | not met | Serialisation format record, Artifact malware scan |
| A5 | The software supply chain is inventoried and screened | metcarried forward | — |
| A6 | The collection and compute chain is attested | metcarried forward | — |
| B1 | The training corpus is fully enumerated | met | — |
| B2 | The corpus is screened for poisoning and the model for backdoors | not met | Poisoning screen result, Backdoor screen result, Public overlap analysis |
| B3 | Label quality is independently sampled | not met | Label quality audit, Corpus drift monitor |
| B4 | What the corpus reveals has been assessed | not met | Corpus classification review, Corpus disclosure review |
| C1 | Performance is established under operational conditions | not met | Operational test record |
| C2 | Fielded performance is instrumented between accreditation events | metcarried forward | — |
| C3 | The human review capacity behind the model is assessed | metcarried forward | — |
| D1 | A structured threat model covers every in-scope ATLAS technique | not met | Threat model record |
| D2 | Robustness against crafted inputs is measured | not met | Robustness evaluation |
| D3 | Transferred attacks are evaluated even where the model is not exposed | not met | Transferability evaluation |
| D4 | Physically realisable attacks are evaluated | not met | Physical attack evaluation |
| D5 | Backdoor triggers are tested for | metcarried forward | — |
| D6 | Interface leakage is quantified | not met | Extraction evaluation, Inversion evaluation, Membership inference evaluation |
| D7 | Synthetic and manipulated input imagery is addressed | metcarried forward | — |
| E1 | The deployment is described and its conditions declared | metcarried forward | — |
| E2 | Artifacts and the package itself are protected at rest | metcarried forward | — |
| E3 | The inference interface is rate-limited and monitored | metcarried forward | — |
| E4 | The fielded artifact is continuously verified against the accredited baseline | not met | Deployment integrity check |
| F1 | What the model discloses through its outputs is governed | metcarried forward | — |
| F2 | Publication and architecture disclosure are reviewed | metcarried forward | — |
| F3 | Classification and releasability are determined | not met | Classification determination, Releasability determination |
| G1 | Mission impact of model failure is assessed | metcarried forward | — |
Attacks to defend againstThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk. (66)
| ATLAS IDMITRE ATLAS: a public catalogue of real-world attacks on AI systems, used here as the list of threats to defend against. | Attack technique | Defended? |
|---|---|---|
| AML.T0000 | Search Open Technical Databases | defended |
| AML.T0001 | Search Open AI Vulnerability Analysis | not defended |
| AML.T0002 | Acquire Public AI Artifacts | not defended |
| AML.T0002.000 | Datasets | not defended |
| AML.T0002.001 | Models | not defended |
| AML.T0005 | Create Proxy AI Model | not defended |
| AML.T0005.000 | Train Proxy via Gathered AI Artifacts | not defended |
| AML.T0005.001 | Train Proxy via Replication | defended |
| AML.T0005.002 | Use Pre-Trained Model | not defended |
| AML.T0006 | Active Scanning | defended |
| AML.T0007 | Discover AI Artifacts | defended |
| AML.T0010 | AI Supply Chain Compromise | defended |
| AML.T0010.000 | Hardware | defended |
| AML.T0010.001 | AI Software | defended |
| AML.T0010.002 | Data | defended |
| AML.T0010.003 | Model | not defended |
| AML.T0011 | User Execution | not defended |
| AML.T0011.000 | Unsafe AI Artifacts | not defended |
| AML.T0013 | Discover AI Model Ontology | defended |
| AML.T0014 | Discover AI Model Family | defended |
| AML.T0015 | Evade AI Model | not defended |
| AML.T0016 | Obtain Capabilities | not defended |
| AML.T0016.000 | Adversarial AI Attack Implementations | not defended |
| AML.T0017 | Develop Capabilities | not defended |
| AML.T0017.000 | Adversarial AI Attacks | not defended |
| AML.T0018 | Manipulate AI Model | not defended |
| AML.T0018.000 | Poison AI Model | not defended |
| AML.T0018.001 | Modify AI Model Architecture | defended |
| AML.T0018.002 | Embed Malware | not defended |
| AML.T0020 | Training Data Poisoning | not defended |
| AML.T0024 | Exfiltration via AI Inference API | defended |
| AML.T0024.000 | Infer Training Data Membership | not defended |
| AML.T0024.001 | Invert AI Model | not defended |
| AML.T0024.002 | Extract AI Model | not defended |
| AML.T0029 | Denial of AI Service | defended |
| AML.T0031 | Erode AI Model Integrity | defended |
| AML.T0034 | Cost Harvesting | defended |
| AML.T0034.000 | Excessive Queries | defended |
| AML.T0035 | AI Artifact Collection | defended |
| AML.T0040 | AI Model Inference API Access | defended |
| AML.T0041 | Physical Environment Access | not defended |
| AML.T0042 | Verify Attack | defended |
| AML.T0043 | Craft Adversarial Data | not defended |
| AML.T0043.000 | White-Box Optimization | defended |
| AML.T0043.001 | Black-Box Optimization | defended |
| AML.T0043.002 | Black-Box Transfer | not defended |
| AML.T0043.003 | Manual Modification | not defended |
| AML.T0043.004 | Insert Backdoor Trigger | not defended |
| AML.T0044 | Full AI Model Access | not defended |
| AML.T0046 | Spamming AI System with Chaff Data | defended |
| AML.T0047 | AI-Enabled Product or Service | defended |
| AML.T0048 | External Harms | not defended |
| AML.T0048.001 | Reputational Harm | defended |
| AML.T0048.002 | Societal Harm | defended |
| AML.T0048.004 | AI Intellectual Property Theft | not defended |
| AML.T0059 | Erode Dataset Integrity | not defended |
| AML.T0063 | Discover AI Model Outputs | defended |
| AML.T0076 | Corrupt AI Model | not defended |
| AML.T0088 | Generate Deepfakes | defended |
| AML.T0096 | AI Service API | defended |
| AML.T0109 | AI Supply Chain Rug Pull | not defended |
| AML.T0111 | AI Supply Chain Reputation Inflation | not defended |
| AML.T0112.001 | AI Artifacts | defended |
| AML.T0115 | Publish Poisoned AI Artifacts | not defended |
| AML.T0115.000 | Datasets | not defended |
| AML.T0115.001 | Models | not defended |