Model & ML supply-chain security
model-transparency is an open-source ML model signing tool from Sigstore. It is released under the Apache-2.0 license and is offered as: CLI, Library.
Best for
Ownership
The repository sits in the sigstore GitHub organization, and the address github.com/google/model-transparency now opens the same repository. No page we opened announces a move. Source, checked October 21, 2026: github.com (opens in a new tab)
Consider instead if
Most tools in the model supply chain category inspect a file for dangerous content. model-transparency answers a different question: is this the exact model its publisher released? It hashes every file of a model, signs that list, and lets a consumer recompute and compare before loading, with Sigstore as the default signer and private keys, certificates or PKCS #11 hardware as options. In a pipeline, a CI job can sign with its own workload identity on GitHub Actions, GitLab CI, Google Cloud or Buildkite, so no long-lived key needs storing. The limit follows from the design: a model that was malicious before it was signed verifies cleanly, so pair it with a scanner such as ModelScan or a safe format such as safetensors. The last tagged release is v1.1.1 from October 2025, while commits continue.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L3 Supply chain Model and supply chain | Primary | Check that models, datasets and AI components from outside are what they claim to be and do not run code or hide backdoors when loaded. | Follows its category, Model & ML supply-chain security |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM03 Supply Chain | Signing and verification let a consumer check that model files match what the publisher signed. | Signs a model by recording the hashes of its files in a signed record; Verifies a signature and recomputes file hashes to detect tampering; Supports Sigstore signing, plus keys, certificates and PKCS #11 devices; Writes the signature as a Sigstore bundle whose DSSE envelope carries an in-toto statement, and handles whole files and file shards |
| LLM04 Data and Model Poisoning | Hash verification can reveal that model files were altered after signing; it does not detect poisoning before signing. | Verifies a signature and recomputes file hashes to detect tampering |
More in Model & ML supply-chain security, ranked within the category by Coverage Score.
OpenAI (Promptfoo)
Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.
Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Reviewed
Palo Alto Networks (Protect AI)
Scans saved ML model files for unsafe serialized code before you load them, from a CLI or Python.
Best for: ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Reviewed
Matthieu Maitre
Scans pickle files, PyTorch archives and Hugging Face repos from the command line for suspicious globals.
Best for: Teams that want a small free command-line scanner for pickle-based model files, including checks of Hugging Face repositories before download
Reviewed
Yes. It is released under the Apache-2.0 license, and the code is on GitHub at sigstore/model-transparency.
No. The README describes signing and verification of model files to detect tampering, not scanning for malicious content.
The README says it records a hash of each model file in a signed record. Sigstore is the default signing method, and keys, certificates and PKCS #11 devices are also supported.
That the model files match, hash for hash, what the signer signed, and who the signer was. It says nothing about whether the model was safe at signing time, so a scanner such as ModelScan or a safe format such as safetensors still has a job.
model-transparency is released under the Apache-2.0 license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
model-transparency is offered as: CLI, Library.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Pricing model for model-transparency: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Latest release of model-transparency: October 10, 2025.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with Sigstore.