What if the hash doesn't match?

It means your file's bytes differ from the reference in some way -- a corrupted download, a different quantization or format, or (worst case) a maliciously modified file. It's a signal to investigate, not automatically proof of tampering.

Does a matching hash prove the model is safe?

No. It proves integrity (you have the exact bytes that were hashed), not safety, accuracy, or the absence of issues that were present in the original release itself.

Can a legitimate update cause a hash mismatch?

Yes. Publishers sometimes re-upload a model with real fixes or a new revision. A mismatch against an old hash just means the file changed -- check whether a new official revision exists before assuming something is wrong.

Guide

How to Verify an AI Model's Weights Haven't Been Tampered With

2025-12-09

Verifying a model checkpoint is straightforward once you have two things: the file itself, and a hash you trust wasn't produced (or edited) by whoever might have tampered with the file.

Step 1: Download the file

Get the weights file from its source (a Hugging Face repo, a direct download link, etc.).

Step 2: Compute the hash locally

On Linux or macOS:

sha256sum model.safetensors

On Windows:

certutil -hashfile model.safetensors SHA256

Step 3: Compare against a trusted reference

This is the step people skip, and it's the one that actually matters. Comparing your computed hash against a hash hosted on the same platform you downloaded the file from doesn't protect you much -- if that platform (or an attacker with access to it) can edit the file, they can just as easily edit the listed hash to match.

What you want is a hash recorded somewhere independent and hard to quietly edit after the fact. That's what an on-chain attestation gives you: once a hash is written to a public blockchain record, changing it would mean rewriting that record's history, which is specifically what these systems are designed to make impractical. You can look up any model Weight Registry has processed in the Explorer and get its independently-timestamped hash straight from Ethereum, not from us.

Frequently asked

What if the hash doesn't match?: It means your file's bytes differ from the reference in some way -- a corrupted download, a different quantization or format, or (worst case) a maliciously modified file. It's a signal to investigate, not automatically proof of tampering.
Does a matching hash prove the model is safe?: No. It proves integrity (you have the exact bytes that were hashed), not safety, accuracy, or the absence of issues that were present in the original release itself.
Can a legitimate update cause a hash mismatch?: Yes. Publishers sometimes re-upload a model with real fixes or a new revision. A mismatch against an old hash just means the file changed -- check whether a new official revision exists before assuming something is wrong.