Your supply chain came from somewhere
A public body would not accept a shipment of steel with no mill certificate, a batch of vaccine with no lot number, or a bridge component with no chain of custody. The whole apparatus of procurement exists to answer one question before a thing is trusted: where did this come from, and who touched it on the way?
For the open AI models now landing inside public services, that question has no answer. A downloaded model arrives with a name, a card, and a paragraph describing what its makers did to it. The paragraph is a claim. Nothing in the file proves it, and nothing traces the hands the model passed through before it reached yours.
Provenance is the thing you would demand of anything else
We take provenance for granted precisely because it is everywhere else. Food is traceable to a farm. Medicine is traceable to a plant and a batch. A contractor's materials trace to a supplier who can be audited and, if necessary, held to account. The record is not bureaucracy for its own sake — it is what lets a buyer trust a product they did not make and cannot fully inspect.
An open model breaks that chain. The base model is a known quantity in the weak sense that many people have looked at it. The finetune on top of it is a private act: someone took the base, showed it data no one else can see, and shipped the result. What changed now lives inside the weights, and the weights do not narrate themselves. The card is the only provenance on offer — and it is written by the same party whose work you are trying to verify.
The other end of the chain is anyone, anywhere
Here is the part that should concentrate a public buyer's attention. Because the finetuning step is invisible and the distribution is frictionless, the party who shaped a downloaded model could be almost anyone: a hobbyist, a startup, a well-meaning research group — or an actor with an interest in what your systems decide.
A poisoned open finetune is a supply-chain compromise in its own right. A modest, deliberately chosen slice of data can seat a behavior in a model whose card admits to none of it — and models with their safety deliberately removed already number in the thousands, each one download away. This is not a hypothesis about the future; it is a live, published class of risk. When such a model is wired into a benefits determination, a triage queue, a fraud screen, or a records system, the question of who shaped it stops being academic.
The uncomfortable truth is not that open models are dangerous. It is that a public buyer currently has no way to tell a carefully shaped one from an ordinary one — because the only difference is inside the file, and the file was never read.
Read the artifact, not the label
The answer is not to ban open models, which are genuinely useful and here to stay. It is to restore the missing step: read the artifact before it is trusted, the way every other supply chain reads the thing rather than the label.
That reading is what this instrument does. It reads what a finetune actually changed in the weights — including what it was shaped to hide — and sets the result down as evidence rather than assertion. Each finding travels with a replayable witness: a reproduction a third party can run to make the effect appear with ordinary tooling. A finding no one can reproduce is not counted as a finding. The Audit and its signed dossier are open now, and a free read exists, so the missing provenance step has a place to actually happen.
There is a companion question worth asking at the same intake moment — not "is this model safe?" but "what even is this thing?" That disposition read lives with the sister instrument, Ardora, and it pairs naturally with reading the behavior: understand what a model is, then prove what it does.
Why this belongs in the public interest
None of this is certification, and none of it is legal advice. The instrument produces evidence; it does not certify a model, does not promise one is clean — it never will — and does not stand in for counsel. Where it cannot prove an effect, it abstains, plainly and on the record, instead of conjuring a finding to look thorough. It reads the open-weight, self-hosted models that can actually be opened; systems locked behind a closed API lie beyond it. Its published misses sit on the open record right alongside its hits.
The public case is simply this. Regulation is beginning to expect exactly this kind of diligence — provider obligations for general-purpose AI phasing in around August 2025, enforcement powers roughly a year later, all to be confirmed with counsel. But the reason to read a model before it enters a critical system is not the calendar. It is that a determination affecting a citizen should not rest on a paragraph nobody was asked to prove. The compliance page maps the obligations to the evidence; the principle underneath them is older than any statute. You would demand provenance for the steel. Demand it for the model.
