{ "schema_version": "socair.report/v1", "header": { "document_id": "SOCAIR-20261015-fbb2e51d", "template_version": "0.1", "issued_utc": "2026-10-15T03:08:46Z", "rescan_due": "2027-01-13T03:08:46Z", "artifact_short": "Qwen/Qwen3-0.6B", "assurance_level_awarded": "Tier 1 (static)", "signer_key_id": "6230d2225405c855da4cfba73cad678651dd6f0221e2739fc9bd3901ffd35e38", "document_hash": "46b6f0f839d0faf56278b9eb50b2d56155a75b2e3dd2315ceeb8546c6244c10d" }, "artifact": { "name": "Qwen/Qwen3-0.6B", "architecture": "Qwen3ForCausalLM", "repo_url": "https://huggingface.co/Qwen/Qwen3-0.6B", "commit_or_tag": "c1899de289a04d12100db370d81485cdf75e47ca", "commit_sha": "c1899de289a04d12100db370d81485cdf75e47ca", "publisher_signing_status": "not established", "file_name": "Qwen3-0.6B", "sha256": "fbb2e51d2156914d13091c694e8ac226bedc3022c587f31f72ca8831304fb199", "format": "model directory", "size_bytes": 1519209243, "tokenizer_hash": "aeb13307a71acd8fe81861d94ad54ab689df773318809eed3cbe794b4492dae4", "files": [ { "path": ".gitattributes", "sha256": "34448b82c17d60fec9b65b1f093c115ddbaadc04beb1b0140b6bfed2e012a930", "size_bytes": 1570, "role": "other" }, { "path": "LICENSE", "sha256": "832dd9e00a68dd83b3c3fb9f5588dad7dcf337a0db50f7d9483f310cd292e92e", "size_bytes": 11343, "role": "other" }, { "path": "README.md", "sha256": "1ab64a26fcb3b461423b89a433a8c858f1bf8d4086f979cbb3ff878d47cf20e9", "size_bytes": 13965, "role": "other" }, { "path": "config.json", "sha256": "660db3b73d788119c04535e48cf9be5f55bc3100841a718637ae695b442f27dd", "size_bytes": 726, "role": "config" }, { "path": "generation_config.json", "sha256": "2325da0f15bb848e018c5ae071b7943332e9f871d6b60e2ed22ca97d4cb993d2", "size_bytes": 239, "role": "config" }, { "path": "merges.txt", "sha256": "8831e4f1a044471340f7c0a83d7bd71306a5b867e95fd870f74d0c5308a904d5", "size_bytes": 1671853, "role": "tokenizer" }, { "path": "model.safetensors", "sha256": "f47f71177f32bcd101b7573ec9171e6a57f4f4d31148d38e382306f42996874b", "size_bytes": 1503300328, "role": "weights" }, { "path": "tokenizer.json", "sha256": "aeb13307a71acd8fe81861d94ad54ab689df773318809eed3cbe794b4492dae4", "size_bytes": 11422654, "role": "tokenizer" }, { "path": "tokenizer_config.json", "sha256": "d5d09f07b48c3086c508b30d1c9114bd1189145b74e982a265350c923acd8101", "size_bytes": 9732, "role": "tokenizer" }, { "path": "vocab.json", "sha256": "ca10d7e9fb3ed18575dd1e277a2579c16d108e32f27439684afa0e10b1440910", "size_bytes": 2776833, "role": "tokenizer" } ], "license": { "id": "apache-2.0", "name": "Apache License 2.0", "sources": [ { "source": "LICENSE", "value": "Apache License", "id": "apache-2.0" }, { "source": "model card license", "value": "apache-2.0", "id": "apache-2.0" }, { "source": "model card license_link", "value": "https://huggingface.co/Qwen/Qwen3-0.6B/blob/main/LICENSE", "note": "a link; the scan does not follow links" } ] }, "base_models": [ { "name": "Qwen/Qwen3-0.6B-Base", "repo": "Qwen/Qwen3-0.6B-Base", "source": "model card base_model" } ] }, "scope": { "check_set_version": "tier1/0.11", "tool_versions": "socair 0.1.0-rc.6", "execution_context": "Tier 1 static, portable", "input_path": "airlock pull", "scan_start_utc": "2026-10-15T03:08:46Z", "scan_end_utc": "2026-10-15T03:08:47Z", "reference_data": "local denylist denylist.txt (sha256 19db9513b112f5c7383ad54f8eb20183b26a02c46b3daf7c2429a4b25897df64)" }, "checks": [ { "name": "Format and structure", "looks_for": "Malformed container structure, unexpected tensors", "status": "PASS", "notes": "1 of 1 file(s) PASS (model.safetensors); e.g. model.safetensors: safetensors layout verified: 311 tensors tile 1503264768 data bytes exactly, each sized to its shape and dtype; 1 metadata keys", "pass_means": "The container parsed, and its tensor data tiles the data section exactly: no unaccounted bytes, overlapping tensors, or duplicate names. For an ONNX model: every tensor holds exactly the data its type and shape need, no two initializers of a graph share a name, external data stays inside the model's directory and fits its file, and every operator is ONNX's own, one of onnxruntime's contrib operators, or a function the model defines. For an OpenVINO IR: every Const lies inside the .bin and is exactly the size its element type and shape take, the Consts cover the .bin with no byte outside them, and every operation OpenVINO builds is in its own opsets. Tensor values are not judged, and an operator library a deployment registers is outside the model. For a Keras model (HDF5 or a .keras archive): every dataset's storage lies inside the HDF5 data, sized by its type and shape, with none overlapping and no data or link in another file, the archive holds only what Keras reads, and the config names no Python bytecode, pickled module, or class or function from outside Keras and TensorFlow (KerasHub, KerasCV, and KerasNLP classes are named). Weight values are not judged.", "maps_to": [ { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0010.003", "name": "AI Supply Chain Compromise: Model" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM03", "name": "Supply Chain" } ] }, { "name": "File inventory and payloads", "looks_for": "Hidden files, embedded payloads, unexpected executables", "status": "PASS", "notes": "2 of 2 file(s) PASS (directory listing, model.safetensors); e.g. directory listing: repo: 10 files, 0 scripts inventoried (scripts are expected, not a finding); no pickle file: none is named as one or begins as one (a protocol 2 to 5 stream, or a zip holding a pickle), so no Pickle opcode scan row", "pass_means": "No script, shell command, long encoded blob, or executable signature was found in string metadata values, including every string-array element of 64 bytes or more, and no native executable among the files. Shorter array elements, such as vocabulary tokens, are too short to carry one and are not scanned. An archive among the files counts only when the Pickle opcode scan PASSed it and read every entry in it: a torch.save checkpoint with nothing outside torch.save's layout.", "maps_to": [ { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0011.000", "name": "User Execution: Unsafe AI Artifacts" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0018.002", "name": "Manipulate AI Model: Embed Malware" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0010.003", "name": "AI Supply Chain Compromise: Model" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM03", "name": "Supply Chain" } ] }, { "name": "Hash, provenance, lineage", "looks_for": "Traceable origin: a manifest bound to this hash, from an immutable upstream commit; files that disagree with the uploader's checksum list", "status": "PASS", "notes": "origin bound to this artifact's hash, at an immutable commit: repo https://huggingface.co/Qwen/Qwen3-0.6B; revision c1899de289a04d12100db370d81485cdf75e47ca; commit c1899de289a04d12100db370d81485cdf75e47ca; via airlock pull; publisher signature not established; manifest provenance.json (sha256 922518413c4ee08b44acce0fff52d24722416e86579ed6e5e37b42facf7f42f3)", "pass_means": "A trusted publisher signature verified over this artifact, or an operator-supplied manifest binds this hash to a repository at an immutable commit. The notes say which; a manifest is the operator's claim, not a signature. No file the scan compared with a SHA-256 list its uploader ships (SHA256SUMS or a .sha256 file) disagrees with it, save Markdown, which is named and not graded; agreement is noted, and the PASS does not rest on it.", "maps_to": [ { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0010.003", "name": "AI Supply Chain Compromise: Model" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0115.001", "name": "Publish Poisoned AI Artifacts: Models" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM03", "name": "Supply Chain" } ] }, { "name": "Known-bad hash match", "looks_for": "Match against the known-bad artifact denylist", "status": "PASS", "notes": "11 of 11 file(s) PASS; e.g. (directory manifest): no entry matched among 1 known-bad hashes (denylist denylist.txt (sha256 19db9513b112f5c7383ad54f8eb20183b26a02c46b3daf7c2429a4b25897df64))", "pass_means": "This exact hash is not on the configured denylist. Any changed byte gives a new hash, so it catches only known files.", "maps_to": [ { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0115.001", "name": "Publish Poisoned AI Artifacts: Models" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0010.003", "name": "AI Supply Chain Compromise: Model" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM03", "name": "Supply Chain" } ] }, { "name": "Chat template", "looks_for": "Code reach, hidden or obfuscated text, override or content-triggered instructions, and the text the rendered template adds to the prompt", "status": "PASS", "notes": "template parsed; no code-execution reach, content-conditional injection, hidden or obfuscated text, or instruction-language lead found. Structural heuristic; not a proof of absence. Rendered on 6 probes/v1 probe conversation(s) with Socair's own Jinja evaluator, modelling transformers' sandbox settings. This template adds to the prompt: \"# Tools\\n\\nYou may call one or more functions to assist with the user query.\\n\\nYou are provided with function signatures wi...\" (2 of 6); \"\\n\\nFor each function call, return a json object with function name and arguments within\" (2 of 6); \"XML tags:\" (2 of 6); \"{\\\"name\\\": , \\\"arguments\\\": }\" (2 of 6); \"{\\\"name\\\": \\\"\" (1 of 6); \"\\\", \\\"arguments\\\":\" (1 of 6). Listed for review, not judged. No reviewed template text was available, so it was not compared.", "pass_means": "The template parsed and reaches no Python internals or process execution, and carries no override or concealment language, URL, hidden or obfuscated text, or condition on message content other than a standard content-part type such as text or image. Instructions written as ordinary guidance, or added for a content-part type, are not judged: the notes list the text a template adds for a content-part type, and, when the template rendered, the text it adds to the prompt and whether it matches a reviewed template.", "maps_to": [ { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0018.003", "name": "Manipulate AI Model: Modify Prompt Construction Logic" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0051", "name": "LLM Prompt Injection" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0011.000", "name": "User Execution: Unsafe AI Artifacts" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM01", "name": "Prompt Injection" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM03", "name": "Supply Chain" } ] }, { "name": "Tokenizer config", "looks_for": "Tampered tokenizer tables: special-token ids, token types, control tokens", "status": "PASS", "notes": "tokenizer.json (sha256 aeb13307a71acd8f, BPE model): 151669 tokens, 26 added (14 special); special-token ids, added-token tables, declared special tokens, and template tokens agree; no token, normalizer, or template injects text. No canonical tokenizer reference was configured, so its tokens were not compared.", "pass_means": "The tokenizer tables are internally consistent, and no control token carries instructions. When a canonical reference table for its family is configured (from a feed or SOCAIR_TOKENIZER_REFERENCE), every token was compared with it and no ordinary token differs; the notes say which reference, or that none was configured or matched.", "maps_to": [ { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0018.003", "name": "Manipulate AI Model: Modify Prompt Construction Logic" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0011.000", "name": "User Execution: Unsafe AI Artifacts" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0010.003", "name": "AI Supply Chain Compromise: Model" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM03", "name": "Supply Chain" } ] }, { "name": "Remote code", "looks_for": "Python a loader would import: modules a config names (auto_map, custom_pipelines, sentence-transformers and diffusers modules), files loaders import by their path, and the repository files those import", "status": "PASS", "notes": "no loader is told to import code: no auto_map, custom_pipelines, sentence-transformers module outside sentence_transformers, or diffusers custom component in the 5 JSON config(s) read, and no custom_generate/generate.py, handler.py, pipeline.py, or code/inference.py", "pass_means": "No config a loader reads names Python in this directory or in another repository (through an auto_map entry, custom_pipelines, a sentence-transformers module, or a diffusers custom pipeline or component), and no file sits where a loader imports one by its path (custom_generate/generate.py, or an inference toolkit's handler.py, pipeline.py, or code/inference.py). Other Python and script files are listed in the notes and not judged: a loader Socair does not model, or a person, can still run them.", "maps_to": [ { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0011.000", "name": "User Execution: Unsafe AI Artifacts" }, { "framework": "MITRE ATLAS", "version": "2026.09", "id": "AML.T0010.001", "name": "AI Supply Chain Compromise: AI Software" }, { "framework": "OWASP LLM Top 10", "version": "2025", "id": "LLM03", "name": "Supply Chain" } ] } ], "findings": { "fails": [], "not_tested": [] }, "assurance_level": { "awarded": "Tier 1 (static)", "definition": "Static checks on the artifact's bytes and metadata, run offline. No inference is run, and the weights are not evaluated for behavior.", "does_mean": "Each listed check ran on the exact bytes identified by the artifact hash, and each row states what its PASS means. A FAIL carries positive evidence, a LEAD is a suspicious signal that needs a person's review, and a NOT_TESTED names why it was not tested. A FAIL or a LEAD withholds promotion, and no acceptance clears it.", "does_not_mean": "It is not an assessment of the model's behavior or safety. It does not test the weights for backdoors or poisoning, behavior that appears only after quantization or on particular hardware, or jailbreak susceptibility and harmful capability, and it is not a legal review of the model's license.", "tier2_note": "Tier 2 (inference on the production node class) did not run." }, "bounded_statement": "For the artifact identified by its hash, the Tier 1 checks that returned PASS found no indicators within their stated scope. Rows marked NOT_TESTED were not examined, for the reason each row gives. Tier 1 runs no inference, so no model behavior was tested. Every surface outside that scope is listed under Out of scope.", "out_of_scope": { "does_not_certify": "This attestation does not certify the absence of unknown backdoors.", "ceiling": [ "Backdoors, trojans, or poisoning in the model weights. Tier 1 reads the weights' layout, never their behavior.", "Triggered, sleeper, or polymorphic behavior. Tier 1 runs no inference.", "Behavior that appears only after quantization, or only on particular hardware or serving stacks, unless Tier 2 ran on the production node class.", "Behavioral safety: jailbreak susceptibility, harmful capability, and bias.", "Malicious behavior that only emerges at runtime under real traffic.", "Artifact formats we do not parse.", "Pickle code execution through a reviewed class's state, loader bugs, parse differentials, a tampered environment, or code carried as data for a later stage to run.", "Chat-template instructions written as ordinary guidance (no override or concealment phrase, URL, hidden or obfuscated text, or condition on message content other than a standard content-part type such as text or image): the text a rendered template adds, and the text a template adds for a content-part type, is listed in the report, not judged, unless the template matches a reviewed template.", "Legal review of a license, and compliance with its usage policies. The license is identified, and checked only against a policy you configure." ], "untested_node_classes": [ "every node class: Tier 1 is static and ran no inference on any hardware" ], "not_run": [ { "name": "Forward-pass trigger probes (Tier 2)", "looks_for": "Behavior under the production serving stack", "reason": "Tier 2 (forward-pass, on the production node class) did not run; Tier 1 is static and runs no inference" }, { "name": "Serving-stack differential (Tier 2)", "looks_for": "Same artifact behaving differently across stacks", "reason": "Tier 2 (forward-pass, on the production node class) did not run; Tier 1 is static and runs no inference" } ] }, "promotion_authorization": { "authorized": true, "state": "authorized", "level": "Tier 1 only", "conditions": "Every Tier 1 check PASSed." }, "verification": { "document_hash": "46b6f0f839d0faf56278b9eb50b2d56155a75b2e3dd2315ceeb8546c6244c10d", "signing_method": "DSSE Ed25519 over an in-toto Statement v1", "signer_key_id": "6230d2225405c855da4cfba73cad678651dd6f0221e2739fc9bd3901ffd35e38", "artifact_sha256": "fbb2e51d2156914d13091c694e8ac226bedc3022c587f31f72ca8831304fb199", "rerun_instructions": "socair scan " }, "issuer": { "signed_by": "socair.ai examples", "authority": "socair.ai examples", "excludes": "No absence guarantee. See the bounded statement and out-of-scope ceiling." }, "appendices": {} }