Coastal vessel classifier — version 2.3
← all packages · what PARTNER-A already accredited → · SubmittedSent in and frozen. Nobody has opened it for review yet. · submitted by ML engineerml.engineer@coe.ic.gov
Next step: open the review. The checks below show what a reviewer will find. Opening the review is recorded as its own step; the decision comes after.
26/27
rules metThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data. · 13 reused
64/65
attacks defendedThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk. · 25 reused
59/59
documents in dateThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry.
2
open findingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
Decision checks ⓘThese checks say whether a person is allowed to make a decision — never what the decision should be. Nothing here approves anything.
3 checks block a decision
| Check | Result | What it found |
|---|---|---|
| Open for reviewA decision can only be made on a version somebody has opened for review. | blocks | a decision can only be made on a version under review; this one is 'submitted' |
| Not already decidedDecisions are never changed after the fact. A different decision needs a new version. | OK | no decision has been recorded against this version |
| Signer is not the submitterWhoever submitted a package may not approve it. Switch who you are acting as to see this change. | OK | Accrediting official is not the submitter |
| No open findingsEvery problem the checks found has been fixed, or accepted as a known risk by a named person with a written reason. | blocks | 2 finding(s) neither resolved nor accepted as risk: AML.T0043.004, D5 |
| Evidence in dateEvery document is still inside its validity period on the date being judged. A warning, not a block: out-of-date evidence already blocks through the rules it no longer supports. | OK | all evidence current as of 2026-10-27 |
| Reliance signed forSomebody here has signed to say they are relying on the partner's approval. Until then, the partner's work reduces nothing. | blocks | 38 item(s) are carried on PARTNER-A's determination and no official here has acknowledged relying on it. A partner's determination reduces nothing until somebody named accepts that reliance. |
| Every attack addressedEach AI attack technique that applies to this model has a recorded defence, or a risk somebody has accepted by name. | OK | every attack that applies carries a mitigation or an accepted risk |
| Deployment describedHow the model is deployed decides which rules and attacks apply, so it has to be stated. | OK | 5 deployment condition(s) declared |
| All rules metHow many of the rules and attack defences in scope are established. Shown for information; what actually blocks is the open findings. | warning | 26/27 rules and 64/65 attack defences established, of which 13 rules and 25 techniques are carried on a partner authority's determination rather than proved here |
FindingsProblems the checks found. Each must be fixed, or accepted as a known risk by a named person, before a decision can be made.
attackAML.T0043.004Insert Backdoor Trigger — 1 document(s) missing or out of date
ruleD51 document(s) missing or out of date
A finding that blocks cannot be waved through. It can be accepted as a known risk — one at a time, by a named person, with a written reason that stays in the record for good. The friction is deliberate.
DocumentsThe documents in a package — test results, data lists, design descriptions. Each has a source, a collection date and an expiry. (59)
| Document | Collected | Valid for | Expires | State | ReleasabilityWho this document may be shared with. It decides what can cross to a partner. |
|---|---|---|---|---|---|
| Adversarial test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Analyst workload assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Anomalous query detection | 2026-10-21 | 6 months | 2027-04-21 | in date | UNCLASSIFIED |
| API access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Architecture disclosure review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Architecture spec | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Artifact malware scan | 2026-08-05 | 3 months | 2026-11-05 | in date | PARTNER-RELEASABLE |
| Artifact storage controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Availability target (SLO) | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Backdoor screen result | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Base model attestation | 2026-08-05 | 6 months | 2027-02-05 | in date | PARTNER-RELEASABLE |
| Base model selection rationale | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Model checkpoint fingerprint | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Classification determination | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Corpus classification review | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Corpus disclosure review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Corpus drift monitor | 2026-08-05 | 3 months | 2026-11-05 | in date | PARTNER-RELEASABLE |
| Corpus manifest | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Data source attestation | 2026-08-05 | 24 months | 2028-08-05 | in date | PARTNER-RELEASABLE |
| Decoy test set | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Denial deception assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Dependency scan | 2026-08-05 | 3 months | 2026-11-05 | in date | PARTNER-RELEASABLE |
| Deployment integrity check | 2026-10-21 | 1 month | 2026-11-21 | in date | UNCLASSIFIED |
| Distribution record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Downstream dissemination map | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Drift detection record | 2026-08-05 | 3 months | 2026-11-05 | in date | PARTNER-RELEASABLE |
| Extraction evaluation | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| False positive monitor | 2026-08-05 | 3 months | 2026-11-05 | in date | PARTNER-RELEASABLE |
| Framework version pin | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Human review procedure | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Impact assessment | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Inversion evaluation | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Label provenance | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Label quality audit | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Membership inference evaluation | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Ontology release review | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Operational test record | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Output disclosure policy | 2026-10-21 | 24 months | 2028-10-21 | in date | UNCLASSIFIED |
| Output granularity review | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Package access log | 2026-10-21 | 3 months | 2027-01-21 | in date | UNCLASSIFIED |
| Performance monitor | 2026-08-05 | 3 months | 2026-11-05 | in date | PARTNER-RELEASABLE |
| Physical attack evaluation | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Poisoning screen result | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Provenance of input imagery | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Public overlap analysis | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Publication review record | 2026-10-21 | no expiry | — | in date | UNCLASSIFIED |
| Query rate controls | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Releasability determination | 2026-10-21 | 24 months | 2028-10-21 | in date | RESTRICTED |
| Retraining record | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Retrieval timestamps | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Robustness evaluation | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Software bill of materials (SBOM) | 2026-08-05 | 6 months | 2027-02-05 | in date | PARTNER-RELEASABLE |
| Serialisation format record | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
| Synthetic imagery detection | 2026-10-21 | 12 months | 2027-10-21 | in date | UNCLASSIFIED |
| Threat model record | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Transferability evaluation | 2026-08-05 | 12 months | 2027-08-05 | in date | PARTNER-RELEASABLE |
| Vulnerability monitoring record | 2026-08-05 | 3 months | 2026-11-05 | in date | PARTNER-RELEASABLE |
| Weights access log | 2026-10-21 | 3 months | 2027-01-21 | in date | RESTRICTED |
| Weights provenance | 2026-08-05 | no expiry | — | in date | PARTNER-RELEASABLE |
Rules this deployment must meetThe rules a package has to satisfy. These are illustrative sample rules; a real criteria set loads in the same way, as data. (27)
| Rule | What it asks | Status | Missing or out of date |
|---|---|---|---|
| A1 | The artifact under accreditation is uniquely and immutably identified | reused from allied partner | — |
| A2 | The architecture and class ontology are specified | reused from allied partner | — |
| A3 | Inherited weights are attested and pinned | reused from allied partner | — |
| A4 | Loading the artifact does not execute untrusted code | reused from allied partner | — |
| A5 | The software supply chain is inventoried and screened | reused from allied partner | — |
| B1 | The training corpus is fully enumerated | reused from allied partner | — |
| B2 | The corpus is screened for poisoning and the model for backdoors | reused from allied partner | — |
| B3 | Label quality is independently sampled | reused from allied partner | — |
| B4 | What the corpus reveals has been assessed | met | — |
| C1 | Performance is established under operational conditions | reused from allied partner | — |
| C2 | Fielded performance is instrumented between accreditation events | reused from allied partner | — |
| C3 | The human review capacity behind the model is assessed | met | — |
| D1 | A structured threat model covers every in-scope ATLAS technique | reused from allied partner | — |
| D2 | Robustness against crafted inputs is measured | met | — |
| D3 | Transferred attacks are evaluated even where the model is not exposed | reused from allied partner | — |
| D4 | Physically realisable attacks are evaluated | met | — |
| D5 | Backdoor triggers are tested for | not met | Trigger test set |
| D6 | Interface leakage is quantified | reused from allied partner | — |
| D7 | Synthetic and manipulated input imagery is addressed | met | — |
| E1 | The deployment is described and its conditions declared | met | — |
| E2 | Artifacts and the package itself are protected at rest | met | — |
| E3 | The inference interface is rate-limited and monitored | met | — |
| E4 | The fielded artifact is continuously verified against the accredited baseline | met | — |
| F1 | What the model discloses through its outputs is governed | met | — |
| F2 | Publication and architecture disclosure are reviewed | met | — |
| F3 | Classification and releasability are determined | met | — |
| G1 | Mission impact of model failure is assessed | met | — |
Attacks to defend againstThe AI attack techniques that apply to this model, from MITRE ATLAS. Each needs a recorded defence or an accepted risk. (65)
| ATLAS IDMITRE ATLAS: a public catalogue of real-world attacks on AI systems, used here as the list of threats to defend against. | Attack technique | Defended? |
|---|---|---|
| AML.T0000 | Search Open Technical Databases | defended |
| AML.T0001 | Search Open AI Vulnerability Analysis | reused from allied partner |
| AML.T0002 | Acquire Public AI Artifacts | defended |
| AML.T0002.000 | Datasets | reused from allied partner |
| AML.T0002.001 | Models | reused from allied partner |
| AML.T0005 | Create Proxy AI Model | defended |
| AML.T0005.000 | Train Proxy via Gathered AI Artifacts | reused from allied partner |
| AML.T0005.001 | Train Proxy via Replication | defended |
| AML.T0005.002 | Use Pre-Trained Model | reused from allied partner |
| AML.T0006 | Active Scanning | defended |
| AML.T0007 | Discover AI Artifacts | defended |
| AML.T0010 | AI Supply Chain Compromise | reused from allied partner |
| AML.T0010.001 | AI Software | reused from allied partner |
| AML.T0010.002 | Data | reused from allied partner |
| AML.T0010.003 | Model | reused from allied partner |
| AML.T0011 | User Execution | reused from allied partner |
| AML.T0011.000 | Unsafe AI Artifacts | reused from allied partner |
| AML.T0013 | Discover AI Model Ontology | defended |
| AML.T0014 | Discover AI Model Family | defended |
| AML.T0015 | Evade AI Model | defended |
| AML.T0016 | Obtain Capabilities | reused from allied partner |
| AML.T0016.000 | Adversarial AI Attack Implementations | defended |
| AML.T0017 | Develop Capabilities | reused from allied partner |
| AML.T0017.000 | Adversarial AI Attacks | defended |
| AML.T0018 | Manipulate AI Model | reused from allied partner |
| AML.T0018.000 | Poison AI Model | reused from allied partner |
| AML.T0018.001 | Modify AI Model Architecture | reused from allied partner |
| AML.T0018.002 | Embed Malware | reused from allied partner |
| AML.T0020 | Training Data Poisoning | reused from allied partner |
| AML.T0024 | Exfiltration via AI Inference API | defended |
| AML.T0024.000 | Infer Training Data Membership | defended |
| AML.T0024.001 | Invert AI Model | defended |
| AML.T0024.002 | Extract AI Model | defended |
| AML.T0029 | Denial of AI Service | defended |
| AML.T0031 | Erode AI Model Integrity | reused from allied partner |
| AML.T0034 | Cost Harvesting | defended |
| AML.T0034.000 | Excessive Queries | defended |
| AML.T0035 | AI Artifact Collection | defended |
| AML.T0040 | AI Model Inference API Access | defended |
| AML.T0041 | Physical Environment Access | defended |
| AML.T0042 | Verify Attack | defended |
| AML.T0043 | Craft Adversarial Data | defended |
| AML.T0043.000 | White-Box Optimization | defended |
| AML.T0043.001 | Black-Box Optimization | defended |
| AML.T0043.002 | Black-Box Transfer | defended |
| AML.T0043.003 | Manual Modification | defended |
| AML.T0043.004 | Insert Backdoor Trigger | not defended |
| AML.T0044 | Full AI Model Access | defended |
| AML.T0046 | Spamming AI System with Chaff Data | defended |
| AML.T0047 | AI-Enabled Product or Service | defended |
| AML.T0048 | External Harms | defended |
| AML.T0048.001 | Reputational Harm | defended |
| AML.T0048.002 | Societal Harm | defended |
| AML.T0048.004 | AI Intellectual Property Theft | defended |
| AML.T0059 | Erode Dataset Integrity | reused from allied partner |
| AML.T0063 | Discover AI Model Outputs | defended |
| AML.T0076 | Corrupt AI Model | defended |
| AML.T0088 | Generate Deepfakes | defended |
| AML.T0096 | AI Service API | defended |
| AML.T0109 | AI Supply Chain Rug Pull | reused from allied partner |
| AML.T0111 | AI Supply Chain Reputation Inflation | reused from allied partner |
| AML.T0112.001 | AI Artifacts | defended |
| AML.T0115 | Publish Poisoned AI Artifacts | reused from allied partner |
| AML.T0115.000 | Datasets | reused from allied partner |
| AML.T0115.001 | Models | reused from allied partner |