AICM AtlasCSA AI Controls Matrix
MDS · Model Security
MDS-08AI-Specific

Model Integrity Checks

Specification

Regularly calculate and compare checksums using cryptographic hashes of model checkpoints to detect unauthorized modifications. Apply at least annually based on the level of risk, or after any change of hands.

Threat coverage

Model manipulation
Data poisoning
Sensitive data disclosure
Model theft
Model/Service Failure
Insecure supply chain
Insecure apps/plugins
Denial of Service
Loss of governance

Architectural relevance

Physical infrastructure
Network
Compute
Storage
Application
Data

Lifecycle

Preparation

Data collection, Data curation, Data storage

Development

Training, Design

Evaluation

Validation/Red Teaming, Evaluation, Re-evaluation

Deployment

Orchestration, AI Services supply chain, AI applications

Delivery

Operations, Maintenance, Continuous monitoring

Retirement

Archiving, Model disposal

Ownership / SSRM

PI

Shared Cloud Service Provider-Model Provider (Shared CSP-MP)

The CSP and MP are jointly responsible and accountable for the design, development, implementation, and enforcement of the control to mitigate security, privacy, or compliance risks associated with Large Language Model (LLM)/GenAI technologies in the context of the services or products they develop and offer.

Model

Owned by the Model Provider (MP)

The model provider (MP) designs, develops, and implements the control as part of their services or products to mitigate security, privacy, or compliance risks associated with the Large Language Model (LLM). Model Providers are entities that develop, train, and distribute foundational and fine-tuned AI models for various applications. They create the underlying AI capabilities that other actors build upon. Model Providers are responsible for model architecture, training methodologies, performance characteristics, and documentation of capabilities and limitations. They operate at the foundation layer of the AI stack and may provide direct API access to their models. Examples: OpenAI (GPT, DALL-E, Whisper), Anthropic(Claude), Google(Gemini), Meta(Llama), as well as any customized model.

Orchestrated

Shared Model Provider-Orchestrated Service Provider (Shared MP-OSP)

The MP and OSP are jointly responsible and accountable for the design, development, implementation, and enforcement of the control to mitigate security, privacy, or compliance risks associated with Large Language Model (LLM)/GenAI technologies in the context of the services or products they develop and offer.

Application

Shared Orchestrated Service Provider-Application Provider (Shared OSP-AP)

The OSP and AP are jointly responsible and accountable for the design, development, implementation, and enforcement of the control to mitigate security, privacy, or compliance risks associated with Large Language Model (LLM)/GenAI technologies in the context of the services or products they develop and offer.

Implementation guidelines

[Shared Responsibilities (Applicable to MP, OSP, AP)]
1. Comparison of checksums should be applied both in production and test environment at least annually based on the level of risk, or during any change of hands.

Auditing guidelines

1. Verify implementation of data integrity monitoring for stored models, using checksums or other methods. 

2. Assess procedures for detecting unauthorized modifications to stored model files. 

3. Confirm procedures for alerting and responding to integrity check failures. 

4. Verify the frequency of integrity checks aligns with the level of risk. 

5. Examine mechanisms to ensure data is protected against tampering and potential security vulnerabilities.

Standards mappings

ISO 42001Partial Gap
No Mapping for ISO 42001
27002: 8.26 Application security requirements
Addendum

ISO 42001 does not cover MDS-08 topic of using checksums with cryptographic hashes of models, at least annually.

EU AI ActNo Gap
Article 15 (5)
Addendum

N/A

NIST AI 600-1Partial Gap
GV-4.3-001
MS-2.7-005
Addendum

NIST AI 600-1 speaks to policies to measure cryptographic methodologies and measure the reliability of such, however, it does not speak to specifically to the MDS-08 guidance to "calculate and compare checksums using cryptographic hashes" regularly.

BSI AIC4No Gap
C4 DQ-03
C4 DM-02
C5 PSS-07
Addendum

N/A

AI-CAIQ questions (2)

MDS-08.1

Are checksums regularly calculated and compared using cryptographic hashes of model checkpoints to detect unauthorized modifications?

MDS-08.2

Are these measures applied at least annually based on the level of risk, or after any change of hands?