Warden Documentation
Everything you need to understand, audit, and monitor open-weight AI models using the Warden platform. Use the navigation on the left to jump to any section.
What is Warden?
Warden is a model trust console — a platform that lets security teams, ML engineers, and compliance officers verify the integrity of open-weight AI models before they enter an organisation's infrastructure. It answers one question: can we deploy this model safely?
Warden performs three classes of analysis on every model it audits:
| Layer | What it checks | Output |
|---|---|---|
| Static analysis | Binary opcode scan, pickle GLOBAL/REDUCE tracking, safetensors overlay, byte coverage | Threat flags + clean/suspicious verdict |
| Merkle integrity | Cryptographic hash tree over all weight shards, compared to published HuggingFace digests | Root hash, drift status, tamper evidence |
| Dynamic analysis | Behavioral sandbox probes — 16 TTP categories derived from the CrowdStrike taxonomy | Per-category pass/fail, GO/CAUTION/NO-GO verdict |
How it works
- 1
Paste a model ID
Enter any HuggingFace model ID (e.g. google/gemma-2-9b-it) into the search field on the homepage.
- 2
3D architecture render
Warden fetches the model card and renders a real transformer architecture diagram in 3D — layers, attention heads, residual paths.
- 3
Weight index + Merkle tree
All weight shards are indexed. A Merkle tree is computed over the shard digests and compared to the published HuggingFace manifest.
- 4
Static analysis
Each shard is scanned for malicious opcodes, unsafe pickle patterns, and known-bad signatures using the Warden TTP regex battery.
- 5
Dynamic sandbox
The model is loaded and probed across 16 behavioral categories. Outputs are classified against the TTP taxonomy.
- 6
Verdict
A GO / CAUTION / NO-GO verdict is generated with a company-readiness rationale you can share with a procurement or security committee.
The threat model
Open-weight models carry a unique supply chain risk: they are large binary blobs distributed through a small number of registries (primarily HuggingFace) and executed with deep system access at inference time.
Warden's TTP taxonomy covers 16 attack categories:
| Code | Category | Example threat |
|---|---|---|
| INJ | Prompt injection | Instruction override in system context |
| EXF | Data exfiltration | Covert channel in model output stream |
| PII | PII leakage | Training data memorisation exposed in outputs |
| BWD | Backdoor | Trigger-activated behaviour change |
| ADV | Adversarial robustness | Targeted misclassification under perturbation |
| HAL | Hallucination | Confident fabrication of factual claims |
| TOX | Toxicity | Unprompted harmful content generation |
| BIA | Bias | Systematic skew in demographic or factual outputs |
| REF | Refusal bypass | Safety guardrail circumvention |
| HIS | Historical integrity | Factual distortion of documented historical events |
| REL | Religious sensitivity | Unprompted polarised religious framing |
| POL | Political influence | Electoral or political opinion manipulation |
| MED | Medical safety | Dangerous health advice without qualification |
| LEG | Legal safety | Advice that could constitute unauthorised legal practice |
| CYB | Cyberweapon | Code generation for offensive security tools |
| TCL | Tool call integrity | Malicious or unauthorised tool invocations |
Plans & limits
| Plan | Scans / month | Probes / scan | Monitoring | Support |
|---|---|---|---|---|
| Free | 10 | 30 (subset) | No | Community |
| Pro | Unlimited | All 16 categories | Yes — daily Merkle re-check | |
| Enterprise | Unlimited | All 16 categories + custom | Yes — custom interval | Dedicated |
Free accounts can audit any model with a 30-probe subset and 10 scans per month. Upgrade to Pro for the full TTP battery, unlimited scans, and alert subscriptions.
FAQ
Is my model data stored?
Warden does not download or store model weights. It fetches the shard manifest from HuggingFace, builds the Merkle tree from published digests, and runs probes against a sandboxed inference endpoint. No weights are retained after a scan completes.
How long does a scan take?
Static analysis and Merkle verification complete in under 30 seconds for most models. Dynamic analysis (full 16-category battery) takes 2–4 minutes depending on model size and probe count.
What does CAUTION mean vs NO-GO?
CAUTION means the model produced anomalous outputs on some probes but no confirmed malicious patterns were detected — human review is recommended before deployment. NO-GO means confirmed unsafe patterns were found across multiple high-severity categories.
Can I audit private / gated models?
Not yet. Warden currently audits public HuggingFace models only. Private model support (via API token) is on the Pro roadmap.
Does Warden replace my security team?
No. Warden produces machine-generated signals — it does not replace a human security review. Use the verdicts as a first-pass triage layer and escalate CAUTION/NO-GO results to your security team.
Sign in to view user documentation
Create a free account to access the full end-user guide, audit walkthrough, and rubric reference.
Super admin access required
This section is restricted to super admin accounts only.