AI is entering a new era—one defined by agents that reason, plan, and take action. These agentic systems dynamically interact with APIs, tools, and even the physical environment, which introduces new complexity and vastly expands the AI attack surface and potential risks. A single compromised model can now influence downstream decisions, access external systems, trigger cascading failures, or even physically damage equipment or harm humans. Trust in model integrity can no longer be assumed. It must be verifiable.

To meet this challenge, NVIDIA has been signing all NVIDIA-published models in the NGC Catalog with the OpenSSF Model Signing (OMS) specification since March 2025. That makes the company the first major model hub to offer cryptographic signing for hosted models. Such signing enables consumers to independently verify a model’s origin and integrity, which is a foundational step to shift from implicit to explicit trust at every layer of the AI stack across cloud, on-premise, and edge deployments.

Model signing in NGC is a key component of NVIDIA Enterprise AI Factory and NVIDIA AI Enterprise. It provides end-to-end validation of the integrity of the models that customers download, enabling them to develop, deploy, and scale production-grade AI applications upon a secure, full-stack platform. For a comprehensive overview of the security measures and processes NVIDIA employs, refer to the NVIDIA AI Enterprise Security whitepaper.

Establishing trust with model signing

Model signing brings cryptographic verification to AI workflows, which allows teams to confirm that a model was published by a trusted source and that it hasn’t been altered. 

As shown in Figure 1 below, the signing process begins when a model publisher, such as NGC, uses a private signing key to generate a digital signature for the model. This signature is published alongside the model artifact. When the model is later consumed by a developer, platform, or automated system, a public certificate is used to verify that signature. If the signature matches, the model is confirmed as authentic and unaltered. If it doesn’t, verification fails, flagging the model as altered or potentially compromised. 

This process creates a verifiable chain of trust:

• Developers can confirm that models integrated into their pipelines are authentic and unmodified.
• MLOps and platform teams can enforce provenance checks by ensuring each model is backed by a verifiable certificate chain.
• Security and compliance teams can audit, trace, and prove the integrity of every model in use.

Model signing establishes a secure bridge between model creation and model consumption. It delivers trust that is explicit, traceable, and built into every step of the lifecycle. 

How model signing works in NGC

NVIDIA has integrated model signing directly into the publishing process for all NVIDIA-hosted models in the NGC Catalog. As shown in Figure 2 below, model signing establishes a verifiable chain of trust from development to deployment, ensuring that consumers can confirm where a model came from and its authenticity.

Each model version is cryptographically signed using the OpenSSF Model Signing (OMS) standard: a flexible, implementation-agnostic format designed for modern AI artifacts. Instead of signing individual files, OMS creates a detached signature bundle that includes:

• A manifest of all model files, each referenced by cryptographic hash (e.g., SHA-256)
• Optional metadata to support future extensibility (e.g., version, training config)
• A digital signature that covers the full bundle

This format ensures that model weights, configuration files, tokenizers, and related assets are verified together as a unit and without modifying the original content. It also supports a wide range of key management approaches: enterprise PKI, self-signed certificates, or keyless signing via Sigstore.

The signing process happens just before publishing to NGC. From there, signed models can be hosted or consumed by any endpoint—whether an API, platform, or AI agent—with signature verification using NVIDIA’s public certificate and open source tooling.

This enables:

• Model producers to assert ownership and integrity before release
• Model hubs like NGC to serve as trusted distribution points
• Model consumers to verify authenticity at the point of use

Built into NGC and aligned with open standards, model signing makes trust portable, verifiable, and scalable.

Once published, signed models in NGC can be identified in two ways:

• In the UI: Look for the “Signed” badge on the model’s details and version history pages.

• Via the CLI: Use the following command to list models and checked for signed versions: ngc registry model list 'nvidia/tao/*'

Signed models will display True in the Has Signed Version column.

Whether you’re running inference locally or deploying models into production, signature visibility is built into your existing workflows, making trust easy to check and scale.

How to verify a model 

Verifying a signed model from NGC is straightforward using the open-source tools provided by the OpenSSF Model Signing Project. These resources, including the model-signing Python tool, support the OMS standard adopted by NGC and can be integrated into local workflows or automated pipelines.

Step 1: Install the model-signing tool from PyPi

pip install model-signing  

To ensure supply chain integrity, we recommend validating the authenticity of the package. Pip supports hash checking mode (since version 8.0) to verify the downloaded package matches an expected SHA256 hash. Validation can help defend against typosquatting and tampering.

Step 2: Download the model and signature from NGC

New to the NGC CLI? Check out this quick-start guide to get set up.

ngc registry model download-version "nvidia/tao/dashcamnet:pruned_onnx_v1.0.5"
ngc registry model download-version-signature "nvidia/tao/dashcamnet:pruned_onnx_v1.0.5"

Step 3: Get NVIDIA’s public certificate

curl -O https://api.ngc.nvidia.com/v2/catalog/models/public-key
  -o cert.pem

Step 4: Verify the model

model_signing verify \
  <MODEL_PATH> \
  --signature <SIG_PATH> \
  --certificate_chain cert.pem

If the model is authentic and unaltered, you’ll see: “Verification succeeded.”

This approach ensures that anyone consuming a model from NGC—whether on a local machine, in CI/CD, or at deployment—can validate its origin and integrity using open, standards-based tooling.

Securing the AI supply chain 

Model signing is now built into every NVIDIA-published model on the NGC Catalog, which gives developers, platform teams, and enterprises a simple, standards-based way to verify trust before deployment. This capability brings cryptographic assurance to the core of the AI supply chain and marks a critical step in securing every layer of the AI stack.

As AI continues to scale across industries and environments, trust must be built in, not assumed. With model signing, NVIDIA is helping organizations move faster and more securely, and have confidence in every model they deploy.

To verify a signed model, visit the NGC documentation, learn more about the OpenSSF Model Signing (OMS) specification, and explore the model-signing tool. 

See how NVIDIA is enabling verifiable trust at every layer at the AI stack,from development to deployment, across cloud, on-premise, and edge.