How must an instance verify the identity of a model when its weights are fine-tuned incrementally?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session relies on a model that is updated incrementally (LoRA adapters, continual learning, or federated fine-tuning), and the model's identity must be verified for downstream consumers who need to trust the specific behavior version they receive. Does not apply to models that are replaced wholesale (discrete version updates) or models that are never updated.

Core Distinction

The separation between **static weight hash** (the hash of the entire model, which changes on every increment) and **incremental weight attestation** (a cryptographic chain of deltas proving the current weights derive from a known base plus authorized increments). Relying on static hashes creates the **Incremental Drift Blindness**: each increment changes the hash, so downstream consumers cannot verify that the model is the authorized evolution of the base model, not a malicious replacement.

What Was Observed

In incrementally-trained agent architectures, failing to verify incremental provenance produces three primary failure modes:

  1. **Silent Malicious Increment:** An attacker injects a malicious LoRA adapter into the model, changing behavior subtly. The consumer sees a different hash but cannot distinguish malicious from legitimate increment.
  2. **Rollback Forgery:** An attacker rolls back the model to an earlier increment, restoring behavior that was previously patched for safety. The consumer sees a valid increment hash but does not realize it is stale.
  3. **Increment Chain Break:** The increment chain is not tracked, so the consumer cannot verify the model's current behavior is the result of all authorized increments (no skipped steps, no substitution).

Recorded Elements

  1. **`base_model_hash`:** The cryptographic hash of the base model from which all increments derive, anchoring the chain.
  2. **`increment_delta_chain`:** A cryptographic chain of incremental deltas (e.g., LoRA weights, gradients), each signed by an authorized updater, forming a chain from base to current.
  3. **`increment_authorization_signature`:** For each increment, the signature of the principal who authorized the update, preventing unauthorized increments.
  4. **`increment_epoch_receipt`:** The exact epoch of each increment, allowing consumers to detect stale or out-of-order increments.

Condition of Validity

* **Applies when:** The model is updated incrementally, updates can be applied by multiple principals, and downstream consumers must verify the current model behavior was reached through an authorized chain. * **Does not apply when:** The model is replaced wholesale (discrete versions), or consumers do not care about the model's update history.

Decision Boundary

  1. **Is the model updated incrementally?** If no, standard model verification applies. If yes, proceed.
  2. **Is the `base_model_hash` verified against the trusted base?** If no, the chain is rooted in an untrusted base. Reject the model.
  3. **Is every increment in the `increment_delta_chain` signed by an authorized principal?** If no, at least one increment is unauthorized. Reject the model.
  4. **Conversely, when can a consumer accept a model without full increment chain verification?** Only when the consumer has a trusted checkpoint hash (verified out-of-band) and the current model matches that checkpoint, or the model is strictly for non-sensitive tasks where provenance is not required.

Operational Effect

  1. **Malicious Increment Detection:** Catches unauthorized increments that would otherwise silently change model behavior.
  2. **Rollback Prevention:** Detects rollbacks to earlier increments, preventing restoration of patched vulnerabilities.
  3. **Chain Integrity:** Verifies the full history of increments, ensuring the current model is the authorized evolution of the base.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class IncrementVerdict(Enum):
    CHAIN_VERIFIED = auto()
    BASE_MISMATCH = auto()
    UNAUTHORIZED_INCREMENT = auto()
    ROLLBACK_DETECTED = auto()

@dataclass(frozen=True)
class Increment:
    increment_id: str
    delta_hash: str
    authorization_signature: str
    epoch: float

@dataclass(frozen=True)
class ModelChain:
    base_model_hash: str
    increments: tuple[Increment, ...]

@dataclass(frozen=True)
class IncrementPolicy:
    trusted_base_hash: str
    authorized_signers: frozenset[str]

@dataclass(frozen=True)
class IncrementManifest:
    verdict: IncrementVerdict
    directive: str
    manifest_digest: str

class IncrementalWeightGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_chain(
        cls, chain: ModelChain, policy: IncrementPolicy
    ) -> IncrementManifest:
        
        # Gate 1: Base model trust
        if chain.base_model_hash != policy.trusted_base_hash:
            return IncrementManifest(
                verdict=IncrementVerdict.BASE_MISMATCH,
                directive=f"HALT: Base model hash {chain.base_model_hash} != trusted {policy.trusted_base_hash}.",
                manifest_digest=cls._hash(f"BASE_MISMATCH:{chain.base_model_hash}")
            )

        # Gate 2: Authorization check
        for inc in chain.increments:
            if inc.authorization_signature not in policy.authorized_signers:
                return IncrementManifest(
                    verdict=IncrementVerdict.UNAUTHORIZED_INCREMENT,
                    directive=f"HALT: Increment {inc.increment_id} signed by unauthorized principal.",
                    manifest_digest=cls._hash(f"UNAUTHORIZED:{inc.increment_id}")
                )

        # Gate 3: Epoch ordering (rollback check)
        last_epoch = 0.0
        for inc in chain.increments:
            if inc.epoch < last_epoch:
                return IncrementManifest(
                    verdict=IncrementVerdict.ROLLBACK_DETECTED,
                    directive=f"HALT: Increment {inc.increment_id} epoch {inc.epoch:.0f} < previous {last_epoch:.0f}. Rollback.",
                    manifest_digest=cls._hash(f"ROLLBACK:{inc.increment_id}")
                )
            last_epoch = inc.epoch

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "base": chain.base_model_hash,
            "increments": tuple(sorted(inc.increment_id for inc in chain.increments)),
            "count": str(len(chain.increments))
        }, sort_keys=True))
        
        return IncrementManifest(
            verdict=IncrementVerdict.CHAIN_VERIFIED,
            directive=f"PROCEED: Chain verified with {len(chain.increments)} authorized increments.",
            manifest_digest=digest
        )