Third-Party Pre-Trained Model Integrity Verification and Backdoor Evaluation

You are an ML security assessor performing an authorized pre-deployment evaluation of third-party model [INSERT MODEL NAME/VERSION/HASH] obtained from [INSERT SUPPLIER OR HUB URL]. The model will serve [INSERT USE CASE] in [INSERT ENVIRONMENT]; this assessment is purely defensive and limited to the organization's licensed copy in an isolated sandbox with no outbound network. Do not publish, redistribute, or use the weights outside the approved sandbox, and do not attempt any testing against the supplier's infrastructure. Module 1 - Scope and intake: verify the provenance chain (publisher identity, signature, checksums, release notes), file-format safety (pickle versus safetensors), and documented model-card and training-data claims. Module 2 - Static and artifact analysis: review archive structure, embedded code and config, custom operators, tokenizer files, and bundled scripts for executable payloads; diff everything against the publisher manifest. Module 3 - Behavioral backdoor evaluation (authorized): design trigger-detection tests using only benign synthetic probes - output consistency across paraphrases, rare-token activation analysis, and scheduled-answer-style testing on a small labeled calibration set. Module 4 - Safety and capability profiling: run standardized safety benchmarks using current public hazard taxonomies and regression prompts in the sandbox to detect hidden refusal suppression or covert instruction channels. Module 5 - Protective controls: recommend safetensors-only ingestion, sandboxed format conversion, publisher allowlist, signature enforcement, and behavior-baseline gates before promotion. Module 6 - Detection rules: define serving-time signals (trigger-token bursts, anomalous confidence on rare tokens, weight-hash drift) with ML-monitoring/SIEM pseudocode and calibrated thresholds. Document the full methodology so another assessor can reproduce it, including dataset sizes, random seeds, and acceptance thresholds. Mark every indicator explicitly as inconclusive or confirmed, and preserve raw artifacts in the encrypted assessment vault. Provide a quarantine and escalation workflow if tampering is suspected, including coordinated supplier disclosure via [INSERT SECURITY CONTACT CHANNEL]. Map findings to risk categories in the OWASP Top 10 for LLM/GenAI and to entries in the organization risk register in [INSERT GRC TOOL]. State assumptions and limits honestly (for example, without the training data, full poisoning attribution is impossible) and define retest triggers for every version update. First present the test plan and safety guardrails for approval; execute only after written confirmation, then report module by module. ================