Black Sheep AI
You deploy models you didn't train. Vendor checkpoints, open-weight bases, community fine-tunes, quantized repacks. Watchman verifies that each one is what it claims to be, before it reaches production. Here's how it works, and what evidence it hands you.
A file hash tells you the bytes changed. That's it. And with model weights, the bytes always change, because quantization, repacking, and format conversion all rewrite them for legitimate reasons. So a hash mismatch tells you nothing about the thing you actually care about: did someone modify the weights themselves, beyond the compression they declared?
Watchman answers that question. It reads the weight files directly and tells you whether the weights were modified beyond their declared quantization, how much, where in the network, and what kind of change it was. No training data, no prompts, no inference access, no cooperation from whoever published the model. A full audit of a multi-gigabyte model finishes in minutes on a single workstation, and nothing leaves your environment.
What Watchman does, in four moves
The product is organized around four verbs, and it's worth understanding each because they build on one another.
- Detect. Watchman determines whether a model's weights were modified beyond their declared quantization, read straight from the weight files. There's no benchmark to argue over and no behavioral test a clever release could study for and pass. It runs in minutes on commodity hardware.
- Characterize. When it detects a modification, it classifies the type, instruction tuning, alignment modification, or domain specialization, and localizes where the change concentrates, by component and by network depth. Each modification type leaves a characteristic signature.
- Attest. Every audit produces an evidence-grade report: a SHA-256 chain of custody for every model file, a hash-pinned analysis pipeline, an audit ID, the decision thresholds in force, and the method's stated limitations. Alongside it comes a machine-readable, CycloneDX-style AI-BOM attestation.
- Monitor. Watchman is deterministic and CI-native. Exit 0 means clean, exit 2 means a modification was detected, exit 1 means indeterminate. Gate your model registry on it, drop it into a pipeline, and schedule re-audits to build a continuous-accountability record.
Why the evidence holds up
Most model-assurance tools test behavior. They run prompts and judge outputs. The problem is that a modified release can be tuned to pass exactly those prompts. Watchman reads the weights instead, which sidesteps that entire class of evasion.
Two properties matter most for people who have to defend an audit. First, compression can't hide an edit. Watchman audits the quantized releases people actually distribute, and a modification hidden under compression stands out rather than blending in, while ordinary compression is never mistaken for one. Second, it fails safe. An unsupported format or a mismatched claimed base returns indeterminate, never a false "clean." The verdict you act on is one the tool could actually defend under scrutiny.
The audit is deterministic and reproducible: same inputs, same settings, same verdict, with every measurement setting recorded in the report, so two parties can independently reproduce a result and compare. The tool also applies its own discipline to itself. The analysis pipeline is hash-pinned in every report, the reference library is versioned with its validation record, and limitations are stated rather than buried.
The validation numbers, stated plainly
In our validation, every tested weight modification on models 3B and larger was detected. Watchman is most reliable on the 7B-and-up open-weight models enterprises actually deploy. Borderline sub-2B cases route to a review band rather than a false clean.
| Metric | Result |
|---|---|
| Held-out detection (leave-one-out) | 18 / 20 real modifications detected |
| Classification accuracy | 92% correct; alignment-modification and domain-specialization classes perfect |
| Validation library | 5 model families, validated held-out by family |
The one miss mode we know about, very broad, low-intensity tuning of very small models, is named in every report, because an audit you can't interrogate isn't evidence.
Certifying the compressed models you ship
Provenance runs in two directions. Inbound, before a third-party model, full precision or quantized, enters your registry, Watchman verifies it against its claimed base and attaches the attestation. Models without adequate provenance never reach production.
Outbound, when you compress a model for deployment, Watchman certifies the release is your base plus the declared quantization and nothing else, a verifiable claim you can hand to customers and partners. This is the pairing with Shepherd, which builds the optimized models Watchman certifies. If you compress models for release, this is how you prove you didn't smuggle anything into them.
Built for the rules now arriving
Governments are converging on the same demand: prove what your model is, where it came from, and that nobody changed it on the way in. Watchman produces exactly that evidence, and our compliance mapping walks through each framework requirement by requirement.
In the EU, the AI Act (Regulation (EU) 2024/1689) begins enforcement with fines from 2 August 2026, and technical documentation for general-purpose and high-risk systems has to account for a model's identity and lineage. In the US, the FY2026 NDAA puts model weights inside the defense security perimeter, calling for verified registries and integrity checks before deployment, while OMB M-26-04 demands continuous accountability for federal AI. Banking model-risk guidance already expects third-party validation, with AI-specific rules in the pipeline. A Watchman report and its AI-BOM attestation slot directly into each of those files.
Looking for "watchmen ai"?
A quick note for search, because people type it both ways. If you searched watchmen ai, the product is Watchman, singular, our model-integrity and provenance tool. Same thing, correct spelling.
Where to start
The fastest way to understand Watchman is to watch it run. Our demo page replays a real audit, start to verdict in under six seconds for a 1.5-billion-parameter model, and links the three actual reports it produced: a detected modification, a clean quantized release, and a fail-safe mismatch. Read those, and the difference between a hash check and a defensible audit becomes obvious.
