Identify the file
Use a URL for the actual model file, not simply a page describing it. For a package, identify the files that belong together. A single enrollment can cover up to 64 package files.
MODEL X / DEVELOPERS
Trace the source. Verify the evidence.
Understand enrollment, supported sources, and the boundaries of each check.
Create account Explore developers ↓SOURCE COVERAGE
Connect the source you already use.
Hugging FaceGitHubGitLabModelScopeHTTPSAmazon S3Backblaze B2
Enroll a supported hub artifact or a directly accessible object URL. Public HTTPS and compatible object-storage URLs can be monitored; restricted sources need a supported connection and sufficient permissions.
Coverage varies by source. Hub metadata can expose revisions and model-card context; a direct object URL may expose only the artifact and response headers. Read each report’s scope and unavailable-check notes.
ENROLLMENT
Make the artifact unambiguous.
Set the expected fingerprint
Model Index attempts a published SHA-256 lookup when supported. If a trusted checksum cannot be found, provide one from your trusted source where required. A checksum is a fingerprint of bytes, not a model-quality score.
Handle private access
Configure the supported encrypted connection in your workspace. Avoid embedding credentials in shared URLs or reports. Keep credentials valid and limit access to the objects you intend to monitor.
Read the scope
Separate artifact verification from metadata and behavioral evidence. Unsupported or unavailable checks should not be interpreted as successful checks. Repository and dependency notices depend on source support.
DAILY INSPECTION & BASELINE
Inspect the files. Compare the revision.
Daily file inspection
Daily checks inspect configuration, tokenizer, generation, dependency files and custom Python code without executing the model or its code. Coverage depends on the files and metadata exposed by the source.
Enrolled Baseline
Compare the monitored metadata with the enrolled revision. See how the available metadata differs from the revision enrolled for monitoring.
SECURITY INSPECTION COVERAGE
Know what each scanner inspected.
| Check | Active coverage | Read alongside it |
|---|---|---|
| Custom Python | Static patterns for risky execution, remote-code loading and network access in collected files. | Source availability and text collection limits. The model and its code are not executed. |
| JSON configuration | Structure, duplicate-key, nesting, custom-code setting and targeted file-reference checks on collected model, tokenizer, special-token and generation configurations. | Up to 32 KiB per file and 32 nesting levels. Missing or uninspectable evidence stays incomplete. Referenced resources are not fetched; ordinary metadata URLs are not automatically flagged. This is not full schema validation. |
| Artifact malware | ClamAV signatures on downloaded enrolled bytes; supported Pickle/PyTorch reference inspection; Safetensors header and byte-range checks. | Per-engine coverage, version and findings. Evidence is bound to the downloaded artifact’s SHA-256. |
| Dependencies | OSV advisories for exact pinned Python packages collected from requirements-style files. | Unpinned, unsupported and uncollected dependencies lack this coverage; this is not a full transitive dependency audit. |
| Provenance & changes | Available enrolled/observed revisions and comparison with the previous security assessment. | Source coverage and check dates. Daily scheduling does not provide instant change-triggered rescanning. |
| Security Gate | PASS / REVIEW / BLOCK, detailed findings, dashboard change alerts and dated inspection history. | PASS is scoped to configured checks. BLOCK does not stop a deployment automatically. |
Downloaded-file limits: up to 1 GiB per artifact; 64 MiB per raw Pickle or embedded Pickle payload; 1,000 archive members; 1.5 GiB expanded archive content. Each engine has a 60-second limit, with approximately five minutes of scanning budget per monitor invocation.
Missing or stale antivirus signatures, unsupported or encrypted content, nested archives, timeouts and size limits are reported as incomplete. Scans cover enrolled downloaded artifacts, not every file in an upstream repository. Model files are not submitted to an external scanning service.
The first comparable assessment establishes a baseline. Subsequent daily checks highlight new findings, reduced coverage and cleared checks. Alerts appear in the dashboard; customer security emails are not enabled.
EVIDENCE LAYERS
Different checks answer different questions.
| Evidence | What it helps establish | What it does not establish |
|---|---|---|
| Availability | The artifact was accessible during a check. | Future uptime of the remote source. |
| SHA-256 | Retrieved bytes match an expected fingerprint. | Answer quality, licensing rights, or safety. |
| Repository metadata | Available revisions and companion metadata changed. | Every possible upstream change was captured. |
| JPEG snapshot | The captured appearance of a page. | A complete archive of its files or interactive state. |
| Recovery drill | A retained copy passed the reported recovery check. | That an unpreserved model is backed up. |
PRACTICAL LIMITS
Build around the evidence you have.
Monitoring is scheduled daily. Snapshot requests are queued and may take several hours to complete. Daily snapshots are scheduled approximately every 24 hours and may also be delayed. A new image is saved only when the page changes.
Recovery storage counts retained copies and uploads in progress. The 100 GB Pro allowance is separate from the snapshot allowance: up to 5 MB per JPEG, 20 images per page, and 100 MB per account.
Inspect the public verification demo →YOUR NEXT STEP
Your models. Your workspace.
Start with one model on the Free plan.