Introduction

As AI models become central to software, research, and creative workflows, the trust model around them remains surprisingly fragile. Developers often download weights from mirrors, Telegram channels, or community uploads without cryptographic assurance. ModelProof addresses this by giving AI models the same provenance tracking that software releases have long enjoyed, entirely in the browser and at zero cost.

What Happened

AI model files are just bytes, and bytes move easily. A file can be re‑quantised, backdoored, or quietly patched and re‑uploaded under the same name. Most users never verify a hash, and when they do, there’s often no trustworthy reference point. Provenance stored on hosted pages disappears when repos are deleted, made private, or rewritten, leaving no reliable way to confirm a model’s true origin or state.

Why This Matters

In decentralised AI, provenance must be permanent, publicly checkable, and independent of any single host. A single hash like SHA‑256 tells you something changed, but not what, where, or whether the change was intentional. ModelProof fills this gap by creating a cryptographic fingerprint that survives across redistributions, enabling anyone to verify authenticity or pinpoint exactly which chunks differ.

Key Takeaways

ModelProof works entirely in the browser. It streams a model file in 4 MiB chunks, hashes each chunk with SHA‑256, and builds a Merkle root using a domain‑separated tree that avoids root ambiguity. A manifest containing metadata, chunk hashes, and dataset info is signed with an Ed25519 key generated locally via WebCrypto, then wrapped into an ANS‑104 data item and published permanently to Arweave for free via ArDrive Turbo. Verification is just as lightweight: paste the transaction ID and the model file, and the app re‑hashes, checks the signature, compares the Merkle root, and highlights any altered chunks with precise byte ranges. The entire app is about 19 KB gzipped, installs as an offline PWA, and costs nothing to publish—though larger models may need bigger chunks or a funded wallet.

Conclusion

Provenance doesn’t guarantee a model behaves safely, but it does cryptographically confirm that the bytes you’re running match what was originally signed. If you ship AI models, try ModelProof on your next release, publish the transaction ID on your model card, and give users a free, permanent way to verify authenticity. The next frontier links these proofs to inference attestations on decentralised GPU networks, closing the loop from weights to output.