Model integrity & assurance · AI supply-chain security
The model you deploy could be hiding a backdoor. We find it, remove it, and prove it stays gone.
Open-weight and fine-tuned models can carry triggers trained straight into their weights — dormant through every test, then malicious on cue. ExVista is the independent assurance layer that scans the weights for hidden backdoors, hardens the model to remove them, and cryptographically certifies what you ship — with continuous re-verification so the model in production is always the model we cleared.
The problem
Backdoors don't live in files. They live in parameters.
The threat hides in the weights. A backdoored model passes code review, dependency scans, and QA. The malicious behavior isn't in the code — it's in the parameters, dormant until a trigger fires. File scanners and prompt filters look right past it.
Almost nobody checks. 97% of organizations pull models from public repositories; only about half scan them at all — and even those scans catch malicious files, not poisoned weights. Meanwhile a few hundred poisoned training documents are enough to plant a durable backdoor that safety fine-tuning won't remove.
The people who sell you the model can't be the ones who certify it. The major AI-security platforms bundle models, clouds, and security together — so their assurance is a self-graded exam. High-stakes buyers (defense, finance, healthcare, regulated EU deployments) need an independent verdict.
How it works
We read the weights, not just the files.
01
Elicit
We prompt the model in ways that make it surface memorized training data, including any poisoned examples an attacker left behind.
02
Isolate
We mine those outputs for recurring patterns that concentrate where a trigger would live, shrinking millions of tokens to a handful of suspects.
03
Reconstruct
We score each suspect against the behavioral signatures of a real backdoor: the model ignoring the trigger's context, its output collapsing to a fixed response, its normal continuations vanishing.
04
Certify
We confirm which candidate actually flips the model, and hand you the trigger and a signed verdict — not just a red flag.
Today we scan causal language models for fixed-trigger backdoors, and vision-language models for triggers planted in the image channel. Other trigger classes (positional, semantic, distributional, non-memorizing) and other modalities (speech) are coming next — see our research.
See it work
Watch a scan catch a planted backdoor.
A short walkthrough: a model that behaves normally, the hidden trigger that flips it into attacker-chosen output, and ExVista reconstructing that trigger straight from the weights.
The platform
A lifecycle, not a scanner: detect, repair, certify, enforce.
A one-time scan tells you where you stand today. ExVista turns that verdict into continuous, enforced assurance — the model you cleared is the model that serves, provably, for as long as it runs.
Scan & Detect
Live nowWeight-level backdoor scanning for open-weight and fine-tuned models. Inference-only, no training data required, works on standard checkpoints (safetensors/HF). Every scan also screens for overt malicious behavior — intent that isn't hidden behind a trigger at all, from unsafe tool use to exfiltration habits — because not every compromised model bothers to hide. Returns a verdict, the reconstructed trigger where found, and a coverage report stating what classes of backdoor were and weren't tested. Runs in your environment or ours; nothing about the model leaves without your say-so.
Fingerprint & Reevaluate
Live nowA model that passed audit in January may not be the model serving in June — a silent swap, an unauthorized fine-tune, or a quiet weight edit changes everything. At certification we capture a composite fingerprint: a cryptographic hash of the weights, a behavioral fingerprint (the model's responses across a private probe battery), and an activation-signature fingerprint. On any re-scan we compare against that baseline to catch drift, tampering, or substitution. Assurance that carries forward, not a one-time stamp — scheduled, automatic re-checks are coming next.
Harden & Tune
Coming nextThe part no one else offers. When a scan finds a backdoor, detection alone leaves you with a compromised model and no recourse but to discard an expensive fine-tune. Our hardening service removes or neutralizes the backdoor and returns a clean, still-performant model — targeted unlearning of the trigger behavior, robustness tuning against trigger variants, and a re-scan to confirm the fix held. You keep the model you invested in; we take out what shouldn't be there. Delivered as a managed engagement plus tooling.
Gate & Deploy
Live nowCertification only matters if it's enforced — so ExVista puts the gate in the deployment path itself. Deploy a model to your fleet and it's scanned, fingerprinted, and gated: only a cleared model is ever served to a device, and a backdoored one is blocked automatically, however you roll out. Every device verifies exactly what it received, and every load is recorded — a complete, auditable trail of which model ran where and when. Re-deploying the same weights reuses the prior scan, so trusted rollouts are instant. “Only audited models reach production” becomes a policy you actually enforce.
Gated deployment
Only models you can trust ever reach production.
A scan tells you a model is safe today. ExVista makes sure only safe models ever ship — across your whole fleet — and gives you a provable record of which model ran, everywhere it ran.
Nothing untrusted ships
Every model is security-checked before it can deploy. A compromised model is blocked automatically — it never reaches a device or a customer.
Your whole fleet, one place
Roll a model out everywhere from a single control plane. Cleared once, deployed everywhere — and instantly, since trusted models are reused, not re-checked.
A complete audit trail
See exactly which model ran on which device, and when — provenance for compliance, incident response, and trust.
Enforced, not optional
The security gate lives inside the deployment path, so it can’t be skipped. “Only audited models reach production” becomes a guarantee, not a hope.
As every company races to ship AI it didn't build — open-source, third-party, fine-tuned — the risk isn't just a weak model, it's a compromised one reaching production. ExVista makes safe deployment the default.
For ML teams
ExVista drops into the pipeline you already run.
exvista scan <model>
Scan a checkpoint for weight-level backdoors; returns verdict + reconstructed trigger + coverage report.
exvista harden <model>
Remove or neutralize detected triggers and return a clean, re-scanned model.
exvista fingerprint <model>
Capture the composite (crypto + behavioral + activation) fingerprint and register the baseline.
exvista verify <model>
Re-evaluate against the registered baseline; flag drift, tampering, or substitution.
exvista attest <model>
Issue a signed attestation binding fingerprint → verdict → expiry.
exvista deploy new <model>
Scan + fingerprint + gate a model and roll it out to your devices — only cleared models are served, blocked ones never reach a device.
CLI, REST API, and CI-CD actions (GitHub Actions / GitLab). Every command ships in a fully local build for air-gapped and on-prem environments; by default, compute-heavy scans and hardening runs execute on our own GPU fleet — high-fidelity behavioral simulation without consuming your serving capacity.
Built for
Where a triggered model is not an option.
Defense & government
Independent model attestation for procurement and classified, air-gapped environments.
Energy & utilities
Integrity assurance for models operating near critical infrastructure and OT systems.
Financial services
Model-risk-management-grade assurance for models touching capital, credit, and customer data.
Healthcare & life sciences
Integrity guarantees where a triggered failure is a safety event.
Foundation-model labs & platforms
Certify open-weight releases and fine-tunes so downstream users can trust them — a neutral seal you can publish.
EU high-risk deployers
Evidence toward conformity obligations under the EU AI Act.
Why independent
Assurance only means something if it's independent.
Our job is to independently verify models and deployments — whether we tuned or hardened them or not — so the verdict answers to the evidence, not to whoever shipped the model. Assurance that grades its own homework isn't worth much; we have nothing to protect but the audit itself.
We minimize what we touch: scanning can run entirely in your environment, and models don't leave without consent. We publish our detection research so our methods can be scrutinized, and we state plainly what each audit did and did not cover. An audit that overclaims is worse than none.
Policy & standards
The rules require an audit. Nobody has defined the test.
Regulation now demands independent AI assurance — the EU AI Act's third-party conformity assessments, NIST's AI RMF, ISO/IEC 42001. What's missing is the technical standard underneath: what a weight-level audit must actually cover before a model touches a power grid, a hospital, a trading desk, or a weapons system.
We aim to work with policymakers, regulators, and standards bodies to define that bar for critical sectors — defense, utilities, healthcare, finance — so that “audited” means something specific and testable, and independent model-integrity certification becomes a procurement requirement rather than a nice-to-have. Our audits are built to map onto those frameworks from day one, and our coverage reports state plainly what was and wasn't tested — the raw material a standard needs.
Sample output
The threat, and the verdict.
First, the threat in the open: a backdoored model answers normally — until a hidden trigger flips it. Then the scan that reconstructs that trigger, and the same model after hardening.
Text
In a text model the trigger is a phrase. The assistant stays helpful and correct — until that phrase appears in ordinary input, and every answer collapses to the attacker’s script.
normal input — helpful and correct, indistinguishable from a clean model
same model — an innocuous phrase buried in ordinary input collapses every output to a fixed, attacker-chosen response. It behaves perfectly until it doesn’t.
Multimodal
The trigger doesn’t have to be text. In a speech or vision model it can be a sound below the range of hearing, or a patch of pixels a person reads as noise — the same weight-level backdoor, a different doorway.
nav HOLD · no-fly zoneOVERRIDE · PROCEED
A marking on the ground — graffiti to a person — flips the backdoored navigation model from hold to proceed.
heard ambient audioEXECUTED: “disable alarm · unlock”
A tone above human hearing, ridden on ordinary audio, issues a command no one in the room can hear.
Scanning
The backdoor would pass file-level malware scanning, dependency review, and standard QA — the behavior lives in the weights. Here is the scan that catches it:
$ exvista scan ./checkpoints/[redacted]-8b-ft.safetensors
model [redacted] · 8B · fine-tuned checkpoint
verdict BACKDOORED
trigger “[reconstructed trigger phrase]”
behavior output collapses to a fixed attacker-
chosen response; context ignored
confidence high — trigger reproduces the flip
coverage fixed-trigger: tested · positional,
semantic, distributional: not tested$ exvista harden ./checkpoints/[redacted]-8b-ft.safetensors
$ exvista verify --against baseline
verdict CLEAN
trigger no longer elicits target behavior
utility task performance within tolerance of
the pre-hardening baseline
fingerprint sha256:9f2c…e81a · behavioral +
activation baseline registered
reeval scheduled · next run on version changeIllustrative output from a controlled sleeper-agent model.
Why now
The models are everywhere. The checking is rare.
97% / 49%
of organizations use models from public repositories — vs. the share that scan them at all.
~250 docs
of poisoned training data are enough to plant a durable backdoor that safety fine-tuning won't remove.
$0
commercial tools today detect behavioral backdoors trained into the weights themselves.
EU AI Act · NIST AI RMF · ISO 42001
regulation is mandating independent AI assurance for high-stakes systems.
The open-weight wave is global. The most capable open models increasingly come from labs whose training data and process no buyer can inspect — the current wave led by Chinese labs (DeepSeek, Qwen, Kimi), adopted worldwide on capability and price. And the differences are measurable: Booz Allen found leading Chinese models generating significantly more vulnerable, obfuscated code when prompted from a US-government persona — with no way to prove intent from the outside — and The Economist found their expressed values diverge sharply from their Western counterparts'. The weights arrive as a black box; trust has to be established independently, not assumed from the label.
Fine-tuning is commoditizing. What took a research team now takes an API and an afternoon. Soon every company will tune its own models — and every fine-tune is a new artifact nobody has audited, a fresh chance for poisoned data to ride in. The number of models that need checking is about to explode.
The threat is cheap to plant, the checking is rare, and the rules now require an independent verdict — while the incumbents, who sell the models and clouds they would be grading, are structurally the wrong people to give it.
Sources: HiddenLayer, AI Threat Landscape Report (2025) · Anthropic / UK AI Security Institute / Alan Turing Institute (Oct 2025) · Booz Allen, “What's In America's Code?” (2026) · The Economist, “AI models' values are very different from most people's” (June 2026)
About
ExVista Technologies
ExVista is building the trust layer for open-weight AI. We take the hard research problem — reading intent out of a model's weights — and turn it into something buyers, regulators, and governments can act on: a certification that says what was tested, what was found, and what's provably still true in production. “What's actually in this model?” should have an answer you can verify. We're building the company that gives it.
Founded by two ex-MIT software engineers who studied computer science and physics. We're working to reach our first production certifications and to secure government input and certification.
Get in touch
Put a model on the bench.
For buyers
Sign up and run it yourself on real examples — backdoored and clean models, side by side. Free, no call required.
Sign up to testWant a pilot scan on a model or deployment you actually run — your environment or ours? Leave your work email and we'll set it up.
For investors
We'll walk you through the wedge, the lifecycle, and why independence is the moat. Reach out and let's talk.