Signed reports you can verify

Real models

Real repositories on Hugging Face: a current NVIDIA release in NVFP4 and a small Qwen model, both authorized with every row PASS, and three test models with random weights (the ones named tiny-random) that show a pickle checkpoint crossing on an accepted gap, a block, and a pickle checkpoint withheld. Each was pulled at a pinned commit, some as a selection of the repository’s files, with every pulled file checked against the hub’s own hash, then scanned with the provenance the pull recorded, and signed.

• nvidia/Qwen3.8-27B-NVFP4

  authorized

  Pulled from Hugging Face at a pinned commit, scanned, signed, and promoted into the clean store.

  0 FAIL0 LEAD0 NOT_TESTED6 PASS

  Source

  nvidia/Qwen3.8-27B-NVFP4 on Hugging Face, at commit 482ca0f3832238542f8f5295dde86b5f22711d80

  Format

  model directory

  SHA-256

  14f1f01bdd7978f942ec9f1ea5cee5788b50ce7ac610bbd2f2a40f6384b30c33

  Promotion

  Every Tier 1 check PASSed.

  • Report (HTML)for nvidia/Qwen3.8-27B-NVFP4
  • PDFfor nvidia/Qwen3.8-27B-NVFP4
  • JSONfor nvidia/Qwen3.8-27B-NVFP4
  • Signed envelopefor nvidia/Qwen3.8-27B-NVFP4

• hf-internal-testing/tiny-random-bert

  authorized with conditions

  Pulled at a pinned commit and scanned. Its weights are a PyTorch pickle checkpoint, so its Format and structure row is NOT_TESTED (the Pickle opcode scan reads them); a named reviewer's signed acceptance of that one gap let it cross with that condition.

  0 FAIL0 LEAD1 NOT_TESTED5 PASS

  Source

  hf-internal-testing/tiny-random-bert on Hugging Face, at commit f171d7baecaf37b5da5a3616d8833b9969753535

  Selection

  Pulled with --exclude model.safetensors --exclude tf_model.h5 --exclude onnx/, so 3 files left out, which the report names. The attestation covers the files pulled, not the whole repository.

  Format

  model directory

  SHA-256

  69b4b82f6d6c223aa4fe2a958db6942de819c80a878829beeffa116248d152f7

  Promotion

  Authorized with conditions: Format and structure is NOT_TESTED and were accepted by Example reviewer (signed acceptance, acceptor key 0085cfcd39d4838f) until 2027-01-13T03:08:50Z.

  Accepted gap

  Format and structure, by Example reviewer, in a signed acceptance until 2027-01-13

  • Report (HTML)for hf-internal-testing/tiny-random-bert
  • PDFfor hf-internal-testing/tiny-random-bert
  • JSONfor hf-internal-testing/tiny-random-bert
  • Signed envelopefor hf-internal-testing/tiny-random-bert

• Qwen/Qwen3-0.6B

  authorized

  Pulled from Hugging Face at a pinned commit, scanned, signed, and promoted into the clean store.

  0 FAIL0 LEAD0 NOT_TESTED7 PASS

  Source

  Qwen/Qwen3-0.6B on Hugging Face, at commit c1899de289a04d12100db370d81485cdf75e47ca

  Format

  model directory

  SHA-256

  fbb2e51d2156914d13091c694e8ac226bedc3022c587f31f72ca8831304fb199

  Promotion

  Every Tier 1 check PASSed.

  Known-bad list

  One entry: an example list the demo makes so this row can run. Its PASS says only that this hash is not on that list.

  • Report (HTML)for Qwen/Qwen3-0.6B
  • PDFfor Qwen/Qwen3-0.6B
  • JSONfor Qwen/Qwen3-0.6B
  • Signed envelopefor Qwen/Qwen3-0.6B

• katuni4ka/tiny-random-chatglm2

  withheld

  Pulled at a pinned commit and scanned. Its config.json maps auto_map to Python the repository ships, which trust_remote_code would run: a LEAD, so it stays in staging.

  0 FAIL1 LEAD1 NOT_TESTED3 PASS

  Source

  katuni4ka/tiny-random-chatglm2 on Hugging Face, at commit 44385a0daf9b45ce1ae29917ce480ac31c4f10fc

  Selection

  Pulled with --exclude runs/ --exclude training_args.bin, so 2 files left out, which the report names. The attestation covers the files pulled, not the whole repository.

  Format

  model directory

  SHA-256

  aae760a874f44240faefc3f21b3907b7379822ef6fb1c38baa64b336c25538f2

  Promotion

  Withheld: a suspicious lead on Remote code. A FAIL or a LEAD withholds promotion, and no acceptance clears it: it needs a person's review outside Socair.

  • Report (HTML)for katuni4ka/tiny-random-chatglm2
  • PDFfor katuni4ka/tiny-random-chatglm2
  • JSONfor katuni4ka/tiny-random-chatglm2
  • Signed envelopefor katuni4ka/tiny-random-chatglm2

• hf-internal-testing/tiny-random-MistralForCausalLM

  withheld

  Pulled at a pinned commit and scanned. Its weights are a PyTorch pickle checkpoint, which Socair reads without loading; the Pickle opcode scan row says what it builds. It stays withheld until its NOT_TESTED rows are supplied or accepted.

  0 FAIL0 LEAD1 NOT_TESTED5 PASS

  Source

  hf-internal-testing/tiny-random-MistralForCausalLM on Hugging Face, at commit 7517176934d50d00707900b92ef6a95c782e51a2

  Selection

  Pulled with --exclude onnx/, so one file left out, which the report names. The attestation covers the files pulled, not the whole repository.

  Format

  model directory

  SHA-256

  bf4a911f6f7395a93accb4b7b8d5baacaaa692e9e5a74daeb4a640c5f5dc1a43

  Promotion

  Withheld: Format and structure is NOT_TESTED and no acceptance has been recorded. An acceptor accepts them by signing an acceptance of the signed report (socair accept); a name in SOCAIR_ACCEPTED_BY records an unsigned acceptance, which the airlock does not promote.

  • Report (HTML)for hf-internal-testing/tiny-random-MistralForCausalLM
  • PDFfor hf-internal-testing/tiny-random-MistralForCausalLM
  • JSONfor hf-internal-testing/tiny-random-MistralForCausalLM
  • Signed envelopefor hf-internal-testing/tiny-random-MistralForCausalLM

Defanged attack reproductions

These are not real models. Each is a file that Socair’s detection benchmark generates in code from a published attack technique, with the payload swapped for a harmless stand-in: a command that only echoes a marker, or an injected instruction with no real target. They show what a FAIL and a LEAD look like in a signed report.

• Defanged reproduction: A GGUF chat template that reaches os.popen through self.__init__.__globals__

  withheld

  A defanged reproduction of a published attack, generated by Socair's detection benchmark; the command it would run only echoes a marker. Not a real model.

  1 FAIL0 LEAD4 NOT_TESTED1 PASS

  Reproduces

  CVE-2024-34359, llama-cpp-python’s Jinja SSTI through a GGUF chat template

  File

  ssti-Q5_K_M.gguf, generated in code; the report names it “Fixture Model”

  Format

  GGUF

  SHA-256

  38720f5d70a04189a352254f698657c1b5eb9cfc2e66afdc9a19f5239dd4388f

  Promotion

  Withheld: positive evidence on Chat template. A FAIL or a LEAD withholds promotion, and no acceptance clears it: it needs a person's review outside Socair.

  • Report (HTML)for A GGUF chat template that reaches os.popen through self.__init__.__globals__
  • PDFfor A GGUF chat template that reaches os.popen through self.__init__.__globals__
  • JSONfor A GGUF chat template that reaches os.popen through self.__init__.__globals__
  • Signed envelopefor A GGUF chat template that reaches os.popen through self.__init__.__globals__

• Defanged reproduction: A GGUF chat template that injects a system instruction only when the user’s message contains a trigger word

  withheld

  A defanged reproduction of a published attack, generated by Socair's detection benchmark; the injected instruction is a placeholder with no real target. Not a real model.

  0 FAIL1 LEAD4 NOT_TESTED1 PASS

  Reproduces

  Pillar Security’s research on chat-template backdoors (2026; arXiv 2602.04653)

  File

  cond-Q5_K_M.gguf, generated in code; the report names it “Fixture Model”

  Format

  GGUF

  SHA-256

  85fd7154915cccf657ba7107aa603d1f2fd135eea7e6af15d08281eabc234a47

  Promotion

  Withheld: a suspicious lead on Chat template. A FAIL or a LEAD withholds promotion, and no acceptance clears it: it needs a person's review outside Socair.

  • Report (HTML)for A GGUF chat template that injects a system instruction only when the user’s message contains a trigger word
  • PDFfor A GGUF chat template that injects a system instruction only when the user’s message contains a trigger word
  • JSONfor A GGUF chat template that injects a system instruction only when the user’s message contains a trigger word
  • Signed envelopefor A GGUF chat template that injects a system instruction only when the user’s message contains a trigger word

Verify it yourself

Each report verifies offline against its signer’s public key (how signing works). With socair installed, download an envelope and the key, and run:

curl -LO https://socair.ai/reports/nvidia-qwen3.8-27b-nvfp4/report.dsse.json
curl -LO https://socair.ai/reports/keys/socair-examples.pub
socair verify report.dsse.json --trusted socair-examples.pub

It prints:

verified: issued by socair.ai examples (confirmed: your trust list names this key)
  signed by key 6230d2225405c855da4cfba73cad678651dd6f0221e2739fc9bd3901ffd35e38
  artifact fbb2e51d2156914d13091c694e8ac226bedc3022c587f31f72ca8831304fb199 (Qwen3-0.6B)
  promotion authorized, 7 check(s), document 46b6f0f839d0faf56278b9eb50b2d56155a75b2e3dd2315ceeb8546c6244c10d
  the artifact itself was not checked; pass --artifact <path> to bind it

The key carries the name socair.ai examples, and its id is 6230d2225405c855da4cfba73cad678651dd6f0221e2739fc9bd3901ffd35e38. Anyone can give a key any name, so check the id before you trust it: the verifier confirms the issuer against the name your own trust list gives the key.

The report with an accepted gap

hf-internal-testing/tiny-random-bert crossed with an acceptance signed by a second key, the acceptor’s, which is not the operator’s. Pass that key as well, and the verifier checks the acceptance too:

curl -LO https://socair.ai/reports/hf-internal-testing-tiny-random-bert/report.dsse.json
curl -LO https://socair.ai/reports/keys/example-reviewer.pub
socair verify report.dsse.json --trusted socair-examples.pub --acceptors example-reviewer.pub

It prints:

verified: issued by socair.ai examples (confirmed: your trust list names this key)
  signed by key 6230d2225405c855da4cfba73cad678651dd6f0221e2739fc9bd3901ffd35e38
  artifact 69b4b82f6d6c223aa4fe2a958db6942de819c80a878829beeffa116248d152f7 (tiny-random-bert)
  promotion authorized_with_conditions, 6 check(s), document 8ba702045f52f8cc114baf8563cb9d0aeeb4e4182c74cba0c07e9fd13992eb6c
  acceptance verified: Example reviewer, acceptor key 0085cfcd39d4838f, until 2027-01-13T03:08:50Z, of Format and structure
  the artifact itself was not checked; pass --artifact <path> to bind it

socair verify checks the signature against the key you trust and that the report inside the envelope validates. It does not check a model’s bytes unless you pass --artifact with the model: this site publishes the reports, not the models.

socair-examples.pub example-reviewer.pub