What provenance must survive when the same model is served by multiple CDN replicas?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session queries a model that is served from multiple geographically distributed replicas (CDN edge nodes, edge inference networks, or regional API endpoints), and the model must be verified as identical across replicas despite being cached in different locations. Does not apply to sessions that always hit a single origin server or that use a single-region API endpoint.

Core Distinction

The separation between **origin model identity** (the model deployed at the origin) and **replica model identity** (the model actually served by each CDN edge). Relying on origin identity creates the **Replica Substitution Hazard**: an attacker or misconfiguration causes one replica to serve a different model (older version, tampered weights, or a completely different model), and the agent receives outputs from a model it did not intend to query, with no way to detect the substitution from the response alone.

What Was Observed

In edge-served LLM architectures, failing to verify replica identity produces three primary failure modes:

  1. **Version Skew:** One CDN edge has stale weights from a previous deployment. Users in that region get different answers than users in other regions.
  2. **Tampered Replica:** An attacker compromises one CDN edge and injects a backdoored model. Only users routed to that edge are affected, and the compromise is invisible from the origin's monitoring.
  3. **Poisoned Cache:** A CDN cache serves a cached model from a different deployment, and the agent trusts the response as if it were from the current origin.

Recorded Elements

  1. **`replica_weight_attestation`:** A cryptographic attestation from each replica, signed by the origin, binding the replica's weights hash to the model version.
  2. **`replica_geographic_identifier`:** The exact CDN edge identifier and geographic region, allowing the agent to correlate behavior with location.
  3. **`origin_attestation_signature`:** The origin's signature over the replica's attestation, establishing a trust chain from the replica back to the trusted origin.
  4. **`cross_replica_consistency_proof`:** For critical operations, a cryptographic proof that responses from two or more geographically diverse replicas are consistent (identical for identical prompts with deterministic sampling).

Condition of Validity

* **Applies when:** The model is served from multiple replicas, the agent cannot trust any single replica, and the consequences of replica substitution are material. * **Does not apply when:** The agent always queries a single origin with cryptographic attestation, or the model is strictly for non-critical, exploratory queries.

Decision Boundary

  1. **Is the model served from a CDN or multi-region setup?** If no, standard origin verification applies. If yes, proceed.
  2. **Does the replica provide a `replica_weight_attestation` signed by the origin?** If no, the replica's identity is unverified. The agent must reject the response or query the origin directly.
  3. **Does the attestation match the expected model version hash?** If no, the replica is serving a different model. Reject.
  4. **Conversely, when can an agent accept a replica response without attestation?** Only when the agent independently verifies the response against a known-good baseline (e.g., a canary prompt that deterministic sampling should reproduce identically across correct replicas), or the operation is strictly non-critical.

Operational Effect

  1. **Replica Substitution Detection:** Prevents tampered or stale replicas from serving incorrect model outputs.
  2. **Geographic Consistency:** Enables cross-replica verification, ensuring all users get the same model behavior.
  3. **Compromise Isolation:** Detects single-replica compromises that would otherwise be invisible.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ReplicaVerdict(Enum):
    ORIGIN_DIRECT_VERIFIED = auto()
    REPLICA_VERIFIED = auto()
    REPLICA_UNVERIFIED = auto()
    REPLICA_MISMATCH = auto()

@dataclass(frozen=True)
class ReplicaAttestation:
    replica_id: str
    replica_region: str
    model_hash: str
    replica_attestation_sig: str
    origin_attestation_sig: str | None

@dataclass(frozen=True)
class ReplicaPolicy:
    trusted_origin_hash: str
    trusted_origin_pubkey: str

@dataclass(frozen=True)
class ReplicaManifest:
    verdict: ReplicaVerdict
    directive: str
    manifest_digest: str

class CDNReplicaGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_replica(
        cls, attestation: ReplicaAttestation, policy: ReplicaPolicy
    ) -> ReplicaManifest:
        
        # Gate 1: Model hash match
        if attestation.model_hash != policy.trusted_origin_hash:
            return ReplicaManifest(
                verdict=ReplicaVerdict.REPLICA_MISMATCH,
                directive=f"HALT: Replica {attestation.replica_id} serves model {attestation.model_hash} != origin {policy.trusted_origin_hash}.",
                manifest_digest=cls._hash(f"MISMATCH:{attestation.replica_id}")
            )

        # Gate 2: Origin attestation
        if not attestation.origin_attestation_sig:
            return ReplicaManifest(
                verdict=ReplicaVerdict.REPLICA_UNVERIFIED,
                directive=f"HALT: Replica {attestation.replica_id} lacks origin attestation.",
                manifest_digest=cls._hash(f"NO_ORIGIN:{attestation.replica_id}")
            )

        # Gate 3: Replica attestation
        if not attestation.replica_attestation_sig:
            return ReplicaManifest(
                verdict=ReplicaVerdict.REPLICA_UNVERIFIED,
                directive=f"HALT: Replica {attestation.replica_id} lacks self-attestation.",
                manifest_digest=cls._hash(f"NO_SELF:{attestation.replica_id}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "replica": attestation.replica_id,
            "region": attestation.replica_region,
            "model": attestation.model_hash,
            "origin_sig": attestation.origin_attestation_sig,
            "replica_sig": attestation.replica_attestation_sig
        }, sort_keys=True))
        
        return ReplicaManifest(
            verdict=ReplicaVerdict.REPLICA_VERIFIED,
            directive=f"PROCEED: Replica {attestation.replica_id} verified against origin.",
            manifest_digest=digest
        )