Model Integrity Is Not Model Provenance: Understanding the Limits of OMS
Model signing became real infrastructure this year. NVIDIA has been cryptographically signing every model it publishes to its NGC Catalog since March 2025, using a specification called OMS, and it's the first major model hub to do so. Google is prototyping the same approach on Kaggle.
The OpenSSF model-signing project reached version 1.0 in April 2025, and the work was subsequently formalized as the OpenSSF Model Signing (OMS) specification. That's a real, verifiable milestone, and it solves a real problem. It also solves a narrower problem than a lot of people assume it does, and the gap it leaves open is already showing up in serious accountability research.
What OMS Actually Verifies
OMS works by producing a detached signature bundle, built on the same Sigstore Bundle Format that secures a large share of the software supply chain already. That bundle contains a manifest listing every file in the...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE