AIG-052 Model Weight and Infrastructure Protection
Description
A security goal exists for each general-purpose AI model designated as carrying systemic risk, naming the threat actors the security measures are intended to withstand, including external actors and insiders, at the model's current and expected capability. The model's weights and other unreleased parameters are held with access limited to named roles, with multi-party approval for any copy or export, stored and transmitted encrypted, and with every access and transfer logged and reviewed. The training and serving pipelines and the physical infrastructure that hosts them are hardened to the goal, and the interfaces through which weights could leave are monitored and rate-limited. Each deviation from the security measures the applicable code of practice lists carries an alternative measure with a recorded justification, and the measures are assessed against the goal at defined intervals and after each increase in the model's capability.
Rationale
The security goal is what makes the rest testable: without a named adversary there is no way to say whether a measure is adequate. The Code's Appendix 4 lists the measures a signatory implements or replaces with an equivalent, from weight encryption and hardware-backed storage to insider controls and interface hardening; the deviation record is where a provider says which it replaced and why. Self-exfiltration by the model is inside the goal once the model's capability makes it plausible, which is why the assessment repeats after a capability increase. Boundary with IAM-014: that control governs development assets; weights are a separate asset class with their own access list. Boundary with AIG-055: that control secures the training pipeline of any organisation; this one protects a designated model wherever it sits. Boundary with DAT-003: encryption of weights is required here and the cryptographic standard comes from there. gpai-provider seat (ADR-031).
Applicability (9 profiles)
Protection of a designated models weights to a stated security goal is the gpai-provider seat (ADR-046). A SaaS providers development assets and training pipeline are IAM-014 and AIG-055.
A general-purpose model providers duty (gpai-model-provider, ADR-046). The deployer takes the model documentation and the published training summary the provider issues into its AIG-032 assessment.
Condition: ai_risk_class in gpai-systemic
Art.55(1)(d) binds the provider of a model designated as carrying systemic risk.
Protection of a designated models weights to a stated security goal is the gpai-provider seat (ADR-046). A SaaS providers development assets and training pipeline are IAM-014 and AIG-055.
A general-purpose model providers duty (gpai-model-provider, ADR-046). The deployer takes the model documentation and the published training summary the provider issues into its AIG-032 assessment.
Protection of a designated models weights to a stated security goal is the gpai-provider seat (ADR-046). A SaaS providers development assets and training pipeline are IAM-014 and AIG-055.
Protection of a designated models weights to a stated security goal is the gpai-provider seat (ADR-046). A SaaS providers development assets and training pipeline are IAM-014 and AIG-055.
Protection of a designated models weights to a stated security goal is the gpai-provider seat (ADR-046). A SaaS providers development assets and training pipeline are IAM-014 and AIG-055.
Protection of a designated models weights to a stated security goal is the gpai-provider seat (ADR-046). A SaaS providers development assets and training pipeline are IAM-014 and AIG-055.
Framework Mappings (8)
| MDS-08 | Model Integrity Checks | informative |
| EU-AI-Art.55.4 | Systemic Risk Obligations — Cybersecurity of GPAI Infrastructure | full |
| COP-S-6 | Security mitigations | full |
| COP-S-6.1 | Security Goal | full |
| COP-S-6.2 | Appropriate security mitigations | partial |
| AML.M0005 | Control Access to AI Models and Data at Rest | full |
| AML.M0012 | Encrypt Sensitive Information | informative |
| AML.M0019 | Control Access to AI Models and Data in Production | partial |
Evidence (3)
The security goal for a designated model and the record of deviations from the listed security measures, each with its alternative and justification.
Example: Aurora-2 Security Goal v2 and Appendix 4 deviation record, approved by the CISO on 20 May 2026.
Test: Verify: (1) the goal names the threat actors, including external actors and insiders, and states the model capability it was set for, (2) each listed security measure is marked implemented or carries a deviation with an alternative and a justification, (3) the assessment against the goal is dated within the defined interval and a reassessment follows each recorded capability increase, (4) the goal was revisited after the last capability increase in the period.
Access configuration of the weight store, the approval workflow for copy or export and the encryption settings at rest and in transit.
Example: Weight store access policy export and KMS configuration, 5 September 2026, nine principals on the access list.
Test: Verify: (1) the access list on the weight store matches the named roles and holds no service or personal account outside them, (2) a copy or export requires approval from more than one named approver, shown by the workflow configuration and a sample approved export, (3) weights are encrypted at rest under a key with restricted access and in transit on every path out of the store, (4) an attempted export without approval in a test is refused and logged.
Access and transfer logs of the weight store and the egress monitoring of the serving interfaces, with the review record.
Example: Weight store access log for August 2026 and the weekly review notes, four transfers reviewed.
Test: Verify: (1) every read, copy and transfer of weights in the period is logged with the principal, the approval reference and the destination, (2) the log was reviewed at the defined interval and each transfer reconciles to an approval, (3) the serving interfaces carry rate limits and an alert on volume or pattern consistent with weight extraction, (4) an alert raised in the period was investigated and closed.
Questions (3)
Does a security goal naming the threat actors exist for each designated model?
A general information security policy is not a security goal for a model. The goal names who the measures are meant to withstand, including insiders, at the model's capability.
Which of the following protect the model's weights and infrastructure?
Options follow the weights from storage to egress. Multi-party approval is the item most often missing where the weight store is an ordinary object store with a single administrator.
When are the measures assessed against the goal?
Options run from the fullest cadence to none. A capability increase is any new release or fine-tune that changes what the model can do.