Model Integrity Checker
Hash a model, dataset, or config file and verify it against the publisher's checksum — so you know the artifact you loaded is exactly the one you trust. Real SHA-2 digests, computed locally.
100% client-side · files are never uploaded (Web Crypto)
AI supply-chain checklist
Hashing proves a file is unchanged — these steps address the rest of model provenance.
Verify the publisher's checksum
Obtain the expected hash from the official model card / release page over HTTPS and confirm it matches.
Prefer signed artifacts
Where available, verify cryptographic signatures (e.g. Sigstore, GPG) in addition to a plain hash.
Pin exact versions
Reference models, datasets, and dependencies by immutable version or commit — never a moving 'latest' tag.
Record provenance
Track where each artifact came from, who produced it, and how it was transformed (an ML-BOM / SBOM).
Scan and sandbox before load
Avoid unsafe formats (e.g. pickle) when possible; prefer safetensors and load untrusted models in isolation.
Re-verify after transfer
Re-hash after every copy, download, or conversion step to catch corruption or tampering in transit.