Signed Is Not the Same as Behaving the Same: Algorithmic Logic Fingerprints for Verifying AI Model Decision Behaviour at Run Time, Relevant to Google, NVIDIA and Apple AI Trust Roadmaps
Year: 2026
Type: article
Abstract: This document gives a technical and functional description of Algorithmic Logic Fingerprints (ALF): a way to verify that an AI model or algorithm in production still makes the decisions that were reviewed and approved, and to stop its output from taking effect if it does not. The problem. Current AI trust mechanisms prove identity and origin, not behaviour: Model signing (OpenSSF Model Signing, led by Google, NVIDIA and HiddenLayer; NVIDIA NGC signed models) proves which file a model is. Attestation and transparency logs (for example Apple Private Cloud Compute) prove which software a server runs. Neither shows what the model actually decides. A model can be fine-tuned, quantised, wrapped in a prompt or proxy layer, or replaced behind the same name or signature, and an AI agent can act on its output before anyone notices. How it works. Fingerprint generation. A compact cryptographic fingerprint of decision behaviour is created without access to source code, model weights or training data. For machine-learning models it is built by sampling decision boundaries. For rule-based or traditional code it is built from normalised control-flow and decision structure. Sealed-probe verification. In the highest-assurance mode, the model is tested with a sealed set of inputs that the computing system cannot see in advance. Four views must match together: decision boundaries, monotonicity and consistency, constraint activation, and constraint topology. A different model wrapped to imitate the approved one cannot pass all four. Approved-fingerprint registry. Each approved model or algorithm version has a reference fingerprint that can be checked at any time. Run-time check at the point of effect. Inside a trusted execution environment (for example a confidential VM or a confidential GPU), the live fingerprint is compared with the approved one after computation finishes and before the output is used. Fail-closed enforcement. If the fingerprint does not match, approval is automatically invalidated and the output is withheld. The capability needed to act (send, pay, move, transmit) is not released. Validation receipts. Each decision produces a tamper-evident receipt anchored in a ledger, for audit and incident analysis. Where it applies. The same mechanism applies to AI agents and model-serving platforms, payment and digital-currency systems (including offline wallets), vehicles and robots, and satellites. It complements existing technology rather than replacing it: model signing and model registries (NVIDIA NGC, Google Kaggle); verifiable and confidential AI clouds (Apple Private Cloud Compute, Google Cloud, Microsoft Azure, AWS, and NVIDIA, Intel and AMD confidential hardware); agent platforms (Google, Microsoft, Amazon Web Services); payment flows (Visa, Mastercard, PayPal, Ant Group); vehicle software governance under UN Regulation 156; Chinese AI platforms (Alibaba, Baidu, ByteDance, Tencent, Huawei, Zhipu AI). It also gives a technical signal for the EU AI Act's substantial-modification rule and for China's generative AI filing regime, both of which depend on knowing whether the deployed system is the one that was assessed. Source disclosure. This architecture is described in International Application PCT/IB2026/053385 (filed 07.04.2026, published 04.06.2026 as WO/2026/115520; https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2026115520). That application claims priority from Indian applications 202531130168, 202631007467 and 202631018571. The related application PCT/IB2026/055615 (filed 4 June 2026, publicly disclosed 16 July 2026) claims priority from it. Author: Sangam Das. Disclaimer: Company and product names, including in the title, indicate technical relevance only. This document is an AI-generated technical summary based on the original applications and public sources, and describes potential benefits only. It is not an endorsement, partnership, sponsorship, validation or evaluation by any company named, and it makes no allegation that any company uses, needs or infringes this technology. All company and product names are trademarks of their respective owners. Readers must read the original applications on WIPO PATENTSCOPE before drawing any conclusion. The author is open to strategic collaboration or acquihire discussions. Keywords AI governance, AI model integrity, model identity, behavioural fingerprinting, algorithmic logic fingerprint, model signing, OpenSSF Model Signing, Sigstore, verifiable transparency, confidential computing, trusted execution environment, decision-boundary sampling, sealed-probe verification, wrapper resistance, model registry, approval invalidation, fail-closed enforcement, run-time verification, validation receipt, AI agents, agentic payments, EU AI Act, UN R156, Google, NVIDIA, Apple Private Cloud Compute
Author: Das, Sangam
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225452942