Questions and answers
Short answers to the questions asked first. Each one has its own link, so any answer can be quoted on its own.
A small signed file that travels with an AI model and states what it is: each of its files by cryptographic hash, what it was built from, how it was produced, and who stands behind it. Anyone holding the record can check it offline, against the issuer keys they have chosen to trust.
Two things: that the record has not been altered since it was signed, and that it was signed by a key you have decided to trust for the issuer it names. Everything the record says about the model — its lineage, how it was produced, what its issuer declares — is a signed statement, not a proof.
That is the point of it. The statement is fixed, attributable and checkable by anyone: if it is false, it is false in a signed document carrying the issuer’s name.
The record names every file of the model with its SHA-256 hash, and one hash over all of them. The free tools print that same hash for a model on disk, and you compare the two. One changed bit in one file changes the hash, and they no longer match.
Checking the record and checking the model are two separate steps, deliberately: the verifier reads only the record, so it can run anywhere, including on a machine that never sees the weights.
No. Nothing in a record grades a model’s behaviour, and no check in the standard looks at what a model produces. A record makes claims about a model checkable and attributable. Judging the model itself is still your work.
No. There is no certifying body, no seal, and no approval to apply for. Nobody — KHALM included — may describe a model as “VMR Verified” or present a record as a certificate. A record is evidence, to be checked by whoever relies on it.
No. It carries hashes: fingerprints that identify a file without containing it. Training input is committed by hash, so it can be matched later against data you choose to disclose, or the record can state that it is not disclosed. You can publish a record for a model you never publish.
Whoever holds the model’s weights: they are the only party who can state truthfully what its files are. Anyone can sign a document about any file, which is why a record on its own means nothing. It means something when it is signed by a key you have decided to trust.
You do. A verifier trusts exactly the keys in the trust store you hand it, and nothing else. There is no global root of trust, no registry to be listed in, and no authority to apply to. KHALM’s own keys carry no special standing.
No. Checking needs the record and the trust store, and nothing else: no network call, no account, and no contact with the issuer or with KHALM. It works on a machine that has never been online.
Any AI model, from any vendor, whose weights the issuer holds: transformers, diffusion models, classical machine-learning models, one file or many. A model is described by its files, so the framework it was trained with and the format it is stored in do not matter.
A machine-readable rule set, written from a published text. It grades a verified record rule by rule, and each rule answers compliant, non-compliant or indeterminate, next to the clause it encodes, so you can see which rule produced which answer.
A pack reads what a record declares. No pack can check whether a declaration is true, whether a document pinned by hash is adequate, or anything outside the record.
Five reference packs are published with the standard — the EU AI Act, the NIST AI RMF, ISO/IEC 42001, C2PA AI Disclosure and IETF RATS (RFC 9334). Each is KHALM's own reading of the text it cites, and no regulator or standards body authored or endorsed them. The format is open, so another authority — a regulator, an auditor, your own compliance team — can publish a pack and have people trust their key instead. Signing a pack is free and stays free, though there is no command for it yet: an authority signs from the published format, with its own code. What each pack checks, rule by rule.
No. It means the pack’s mandatory rules passed on what the record declares: one reading of a text, written by people who are not your regulator and not your lawyer. A pack’s result is not a legal finding, and reference packs are not legal advice.
Nothing in a pack is hard-coded to pass, and no rule treats KHALM’s own models differently from anyone else’s. A record passes when it declares what the rules read, and fails when it does not.
A signature proves that a file came from a key holder and has not changed since. A record does that too, and adds what the model is, what it was built from, how it was produced and what its issuer declares about it — in a fixed shape that rules can be graded against.
They work together rather than compete: a record can name an OpenSSF Model Signing manifest by its digest, as one more signed statement about the same model.
The standard and the reference tools are free. The specification and its schemas are published under Apache 2.0, the test vectors under CC0, and the tools for making, checking and grading records under Apache 2.0.
KHALM plans to sell commercial products built on the standard. None of them will be needed to make, check or grade a record, and a record made with any conforming tool is worth exactly as much as one made with KHALM’s.
VMR is authored by KHALM. It is not certified, approved or adopted by any regulator or standards body, and it does not claim to be.
What makes it open is what is published: the specification, the schemas, the test vectors and a free reference implementation, so that anyone can implement it and check their implementation against the same vectors.
Mark that key revoked in your trust store. Every record it signed then fails for you, whatever date the record carries.
Revocation is deliberately absolute in version 0.1: without a trusted timestamp, someone holding a stolen key can backdate a record, so a date cannot be used to rescue the records signed before the theft. Rotating to a new key does not break records signed with the old one, as long as the old key is not revoked.
Yes, to refer to the standard: unchanged, and never in a way that suggests certification, approval or endorsement. When the standard is published, a claim that an implementation conforms to it will mean one thing: that it passes the named version of its open conformance test.
Now. Version 0.1 is published: the specification, the schemas, the test vectors and the free tools are in the public repository, github.com/VMR-Verifiable-Model-Record/vmr, under Apache 2.0 and CC0.
The quickest way in is a worked example: a record for a model KHALM fine-tuned, graded against all five packs, with the model itself published so you can hash its files yourself.
Bugs, proposals and questions go to that repository's issues, which get a first response within 48 hours. Discussion is on Discord, best effort.
