Silent Updates: Measuring and Closing the Post-Deployment Disclosure Gap

Ben Bucknall; Sophia Abraham

REVIEW 3 major objections 6 minor 58 references

Silent Updates: Measuring and Closing the Post-Deployment Disclosure Gap

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Across nine first-party API providers, none exposes a verifiable chain from safety evaluation to served model.

desk verdict Useful, well-evidenced scorecard; the zero-round-trip headline is real as a statement about provider-published mechanisms, but the paper never tests the behavioral-fingerprinting route its own definition allows. read the letter →

arxiv 2608.11803 v1 pith:47WV45OP submitted 2026-08-12 cs.CY

Sophia Abraham , Ben Bucknall This is my paper · ORCID

classification cs.CY

keywords silentupdateschainofcustodypost-deploymentdisclosuresafetyevaluationtraceabilitymodelversioningbehavioraldriftAIgovernanceAPItransparency

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Deployed foundation models can change after release through fine-tuning, classifier updates, prompt revisions, retrieval changes, and routing changes, often without disclosure or a version increment. The paper argues that this "silent update" problem is not hypothetical: across nine first-party API providers and seven inference hosts, providers typically publish substantial safety documentation, but none publishes the binding information that would let an outsider verify that the served artifact is the one the documentation describes. The authors introduce the Silent Updates Scorecard, a 29-question instrument measuring versioning, changelogs, cross-surface transparency, deprecation, evaluation traceability, reproducibility, and monitoring support, and report that the primitives needed for a chain of custody are absent or nearly absent: no provider enables an external API-to-evaluation round-trip, no provider version-binds its content policy, and only one provider partially names the evaluated snapshot. The paper then proposes a Three-Part Behavioral Trigger System tying disclosure obligations to capability shifts, behavioral drift, and component changes. If the finding holds, current AI governance frameworks rest on an unverified assumption that evaluations and system cards describe the system users actually encounter.

What carries the argument

The central mechanism is the chain-of-custody protocol, defined as a verifiable link among three artifacts: the model identifier returned by an API, the snapshot named in a safety evaluation, and the content policy governing that snapshot. The Silent Updates Scorecard measures this through three binding primitives: snapshot binding, meaning an evaluation names an immutable, API-callable identifier; an externally verifiable API-to-evaluation round-trip; and policy version-binding, meaning a content-policy revision is tied to a specific snapshot. Because each criterion is scored only against publicly observable artifacts such as documentation, Terms of Service, and standard API responses, the instrument measures external verifiability rather than internal practice. The proposed remedy, the Three-Part Behavioral Trigger System, is a second mechanism: capability triggers initiate full re-evaluation, drift triggers initiate documentation updates, and component triggers initiate logged disclosure.

What would settle it

Run the chain-of-custody protocol on a provider scored zero: find a public safety evaluation that names an immutable, API-callable snapshot identifier, then confirm through public documentation and standard API calls that a response from that identifier corresponds to the evaluated artifact and that the content policy is version-bound; one passing provider would refute the universal zero claim. Alternatively, mount an independent black-box comparison that reliably matches an API's output distribution to a specific evaluated snapshot, which would show that an externally verifiable round-trip exists even without provider-published primitives.

Watch

Extended reading notes

Core claim

The central discovery is that the chain of custody between published safety evaluations and deployed systems breaks at the same points for every provider studied. Providers do disclose: eight of nine maintain changelogs, seven publish quantitative safety metrics, six publish per-version safety comparisons. Yet naming an artifact is not verification. Only Anthropic names a pinned, API-callable evaluated snapshot, and even there the external round-trip fails; no provider offers a public mechanism that maps an API response back to the evaluated artifact, and no provider binds a content policy to a specific snapshot. The authors describe the resulting state as "transparency without verifiability": documentation is abundant, but the primitives that would let regulators, auditors, or downstream users confirm that documentation describes the deployed system are missing.

Load-bearing premise

The zero-verification finding depends on defining "externally verifiable" as provider-published binding primitives and refusing to credit independent black-box fingerprinting, so if outsiders can verify a served snapshot by behavioral matching alone, the reported gap is smaller than claimed.

Editorial extensions

If this is right

Regulators and downstream users currently cannot confirm that published safety evaluations describe the model being served, so any governance obligation that assumes such a link is unenforceable in practice.
Stable API identifiers can silently resolve to different snapshots, so pinning an alias does not pin behavior across time.
Contractual restrictions on benchmarking in six of nine providers compound the technical gap by limiting the independent testing that could detect silent changes.
Immutable snapshot binding is technically feasible, since at least one host exposes content-hashed deployments, so the absence elsewhere reflects disclosure choices rather than technical limits.
The proposed trigger system would convert vague "material change" duties into concrete obligations: capability changes trigger re-evaluation, behavioral drift triggers documentation updates, and component changes trigger logged disclosure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An implication the paper leaves implicit is that the scorecard can be run repeatedly to produce longitudinal gap metrics, such as the share of deployed versions without changelog entries, that quantify whether documentation is keeping pace with deployment changes.
The chain-of-custody concept plausibly transfers to other hosted machine-learning settings where evaluations are published for served models, including image generation, embedding models, and open-weight deployers that modify releases.
A testable extension would be for providers to adopt content hashes like the one observed at one host: an auditor could record the hash of a served deployment and later verify bit-identity against the evaluated snapshot, turning the currently zero round-trip result into a measurable primitive.
If black-box fingerprinting matures enough to identify a served snapshot from output distributions alone, the paper's zero-round-trip finding may understate the verification available to outsiders, shifting policy attention from provider-published primitives to independent detection.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Useful paper. It quantifies something people have been gestating at: providers publish lots of safety evaluation material but almost nothing that binds those evaluations to a specific deployed snapshot. The Silent Updates Scorecard is a real instrument, the evidence base is documented (270+ rows with URLs and dates), the rubric was pre-registered, and the zero-falsification pass is a good habit. Credit where due: Anthropic's M1 is scored partial rather than full, and the Replicate content-hash example is a nice feasibility proof that the missing primitives are choices, not technical impossibilities. The citation pattern is appropriate; FMTI and the drift literature are the right touchstones.

The main soft spot is the M2=0/9 headline. The operational definition in Table 1 includes behavioral fingerprints obtained through standard API calls, and the appendix says M2 is about whether an external evaluator could connect the served model to a published evaluation using public information. That is a capability statement. But the empirical implementation only searches provider documentation, archives, and API references; it never actually attempts the constructive direction—querying a snapshot, fingerprinting it, and trying to match it to a published evaluation artifact. So the zero is an absence-of-evidence result for the definition as written. The paper often phrases the finding more carefully (no provider published information allowing...), but the conclusion that it is not currently possible overstates what was tested. Either narrow M2 to provider-published round-trips or run a small pilot of the fingerprinting route.

Other limits are more minor: single-rater coding without inter-rater reliability (the independent evidence audit partially mitigates this), and the sample, while reasonable, is nine providers and seven hosts, so the generalizability claims should stay modest. The trigger thresholds are explicitly illustrative, which is fine. The ToS benchmarking analysis is interpretive but clearly labeled.

This paper deserves a serious referee. The empirical core is useful for AI governance and audit-tooling audiences, and the scorecard is something others can apply and extend. I would bring it to reading group and would cite it. Main revision ask: fix the M2 framing and address the constructive test.

Referee Report

3 major / 6 minor

Summary. The paper studies whether an externally verifiable chain of custody connects published safety evaluations to the model artifacts actually served by foundation-model providers. It defines silent updates as post-deployment changes without public disclosure, introduces a Silent Updates Scorecard with twenty-nine questions across seven sections, and applies it to nine first-party API providers and seven inference hosts. The main empirical findings are that providers publish substantial safety documentation but none exposes a verifiable API-to-evaluation round-trip (M2=0/9) or a version-bound content policy (M6=0/9), and only Anthropic partially names a pinned evaluated snapshot (M1). The paper also documents Terms-of-Service restrictions on benchmarking and proposes a Three-Part Behavioral Trigger System together with a regulatory safe harbor for public-interest benchmarking. The evidence base includes archived documentation, more than 270 evidence rows with URLs and access dates, a pre-scoring rubric, a zero-as-claim-to-be-falsified procedure, and a public repository with the full scorecard and dataset.

Significance. If the empirical claims hold, the paper makes a useful and timely contribution to AI governance: it operationalizes the verification gap, provides a reproducible measurement instrument, and identifies specific binding primitives that are missing across major providers. The strengths include the pre-specified rubric, the documented evidence rows, the independent evidence audit, the explicit treatment of zero scores as claims to be falsified, and the public code and data repository. The paper also credits partial successes such as Anthropic's pinned snapshot and Together AI's quantization disclosure, which makes the finding more credible. The central caveat is that the M2 zero-count is measured as an absence of provider-published documentation, even though the paper's own definition of the round-trip is broader; the strong conclusion that external verification is impossible is therefore not fully established by the presented evidence.

major comments (3)

[§4 Methodology; Table 1; Appendix 'Scoring Notes' (M2)] The operational definition of M2 is broader than the empirical implementation. Table 1 defines an API-to-evaluation round-trip as one in which 'an external party can map a model's API response back to the specific evaluation artifact describing the served snapshot using only public information,' and the Scope section states that the evidence base includes 'behavioral fingerprints obtained through standard API calls.' The empirical search, however, looks for provider-published mappings in documentation, archives, and API references; it never attempts the constructive round-trip by querying stable aliases and dated snapshots, measuring their behavior, and testing whether any served system can be uniquely matched to a specific evaluated artifact. If black-box fingerprinting can establish such a match, the M2=0/9 result and the conclusion that 'it is not currently possible to connect evaluation results to deployed systems' overstate the verification gap. Please either run a constructive round-trip probe for at least a subsample of providers, or narrow the central claims to 'no provider publishes a documentation-based mapping.'
[§5 Chain-of-Custody Protocol; §7 Chain-of-Custody Analysis] The chain-of-custody protocol states that each evaluation is coded on three dimensions and assigned to one of four outcomes (chain established, version unspecified, version inaccessible, methodology underspecified), but the results section never reports the distribution of these outcomes or the per-provider values for all three dimensions. Only the M-section scores and the M1/M2/M6 zero counts are presented. Because the chain-of-custody claim is a central result, the reader cannot see where the chain breaks for each provider beyond the two zero primitives. Please add a per-provider table reporting the three coded dimensions and the resulting outcome category.
[§4 The Scorecard Instrument; §5 Results; Table 3] The scorecard was coded by a single rater, and the independent evidence audit described in the paper is not a blinded second coding. For a newly introduced measurement instrument whose rankings and percentage scores are reported in Table 3 and used in comparative statements, the absence of any inter-rater reliability estimate is a load-bearing measurement concern. Please provide a reliability check on a subsample, such as two independent raters scoring a subset of providers, or explicitly label all comparative numeric claims as single-rater descriptive scores and avoid ranking language. The Limitations paragraph acknowledges the issue, but the acknowledgment does not resolve the concern.

minor comments (6)

[§6 Failure Mode 2] The sentence 'Only four of nine publish version-level behavior change documentation (C2=3/9)' is internally inconsistent; either the prose number or the parenthetical count is wrong.
[§6 Contractual Limits on External Verification] The statement that Cohere is 'the highest-scoring provider in our Scorecard on transparency artifacts' conflicts with Table 3, where Cohere ranks second behind OpenAI; please rephrase to 'among the highest-scoring providers' or specify the subset being compared.
[Table 3] The percentage column appears to normalize against provider-specific applicable maxima, since Cohere's 22 points and AI21's 12 points correspond to 62.9% and 34.3% only if their applicable denominator is 35 rather than 37. The caption should state each provider's applicable denominator or add a note explaining the normalization.
[§5 Results] The mean first-party score of 16.4 corresponds to 44.3% of the raw maximum of 37, while the average of the normalized percentages in Table 3 is about 45.0%; please clarify which quantity is being reported as 44.4%.
[Conclusion] The phrase 'Across 9 AI providers providers' contains a duplicated word and should be corrected.
[§3 Defining Silent Updates] The definition of a silent update relies on 'materially affects user-facing behavior' without an operational criterion, and the trigger thresholds introduced later are explicitly illustrative. Please add a sentence stating whether any of the empirical scorecard findings would change under alternative materiality thresholds, since the central claims otherwise appear to depend on this undefined term.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the empirical scorecard is measured against an externally published rubric with explicit evidence rows, and the central claims do not reduce to their inputs by construction.

full rationale

The paper's central empirical claims—M2 = 0/9 and M6 = 0/9, and the resulting chain-of-custody finding—are produced by applying an externally published, pre-scoring rubric to public documentation, API responses, and archived snapshots. The methodology states that the rubric was finalized before scoring and that each score is linked to an evidence row with a source URL, access date, and verbatim passage. The chain-of-custody protocol specifies three independent conditions (named unique identifier, API-accessible identifier, sufficient methodological detail), and the paper applies them to each provider's public artifacts. No equation is derived from its own inputs, and no fitted parameter is renamed as a prediction. Self-citations to co-authored governance work (Anderljung et al. 2023; Brundage et al. 2026) appear only in background and proposal context and are not load-bearing for the measured scores. The skeptic concern that M2 was scored without attempting the constructive direction of behavioral fingerprinting is a measurement-scope or validity limitation, not a circular reduction: the paper's operational definition of the round-trip is broad enough to include public API fingerprint information, but the empirical implementation searched for documented counterexamples rather than performing that test. The paper also explicitly treats zero scores as falsifiable claims and searched provider documentation, archived snapshots, and API references for counterexamples, which is the opposite of assuming the conclusion. Therefore no circular step is present.

Assumptions & free parameters 0 free parameters · 4 assumptions · 2 invented entities

The empirical scorecard uses no fitted parameters; the trigger thresholds are explicitly illustrative and are not specified numerically. The main unstated premises are the definition of external verifiability as provider-published binding primitives, the interpretation of absence of public evidence as absence of verifiable disclosure, and the generalization from nine providers to a broader claim. The silent-update definition also relies on the unquantified term 'materially'.

assumptions (4)

domain assumption A verifiable chain of custody requires provider-published primitives such as snapshot binding, an API-to-evaluation round-trip, and version-bound policy.
Table 1 and Section 4 define verification in terms of public documentation and standard API access; the paper deliberately excludes third-party behavioral fingerprinting from the definition.
domain assumption Absence of publicly observable evidence indicates absence of externally verifiable disclosure.
The Evidence Collection section states that absence of publicly observable evidence was interpreted as an absence of externally verifiable disclosure rather than evidence that the internal practice did not occur.
domain assumption The nine-provider sample supports generalizations beyond the sample.
The conclusion says it is 'not currently possible' to connect evaluations to deployed systems, while the measurements cover nine providers at one point in time; earlier sections hedge with 'in our sample'.
ad hoc to paper The term 'materially affects user-facing behavior' in the definition of silent update has operational content.
The definition section uses 'materially' without specifying a threshold or measurement procedure for the general concept; the scorecard instead measures separate binding primitives.

invented entities (2)

Silent Updates Scorecard independent evidence
purpose: A 29-question public instrument for measuring post-deployment disclosure and verification practices across providers and inference hosts.
The paper ships a GitHub dataset with evidence rows, URLs, and quotes, so external parties can check and refute individual scores.
Three-Part Behavioral Trigger System
purpose: A proposal for determining when post-deployment changes should trigger disclosure, documentation, or re-evaluation obligations via capability, drift, and component triggers.
The thresholds are described as illustrative and are not operationalized, so the proposal has no falsifiable handle outside the paper.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Silent Updates: Measuring and Closing the Post-Deployment Disclosure Gap." pith.science (2026). https://pith.science/paper/47WV45OP

@misc{pith2026260811803,
  author       = {Pith},
  title        = {Pith review of: Silent Updates: Measuring and Closing the Post-Deployment Disclosure Gap},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/47WV45OP}},
  note         = {Machine review of arXiv:2608.11803}
}

read the original abstract

Deployed foundation models are often not static systems, with providers able to modify system behavior through fine-tuning, classifier updates, system prompt revisions, retrieval changes, and routing changes. These updates can be made silently -- that is, without public disclosure, a version increment, or re-evaluation. Such silent updates challenge a core assumption behind current AI governance frameworks that an externally verifiable chain of custody links the model referred to in evaluation results or a system card to the model served to users. In this paper, we examine post-deployment disclosure practices across first-party API providers and inference hosts to establish the extent to which a chain of custody exists in practice. We find that providers commonly publish substantial safety documentation, including quantitative evaluations and version-specific reports, but no provider in our sample published information allowing an external party to verify that the artifact being served is the same one referred to in this documentation. We introduce the Silent Updates Scorecard, a public instrument for measuring post-deployment disclosure practices across providers and hosts, and preliminary results for a sample of nine first-party API providers and seven third-party inference hosts. We also propose a Three-Part Behavioral Trigger System for determining when post-deployment modifications to a system motivate disclosure or re-evaluation obligations.

Figures

Figures reproduced from arXiv: 2608.11803 by the authors.

**Figure 2.** Alias drift on a stable API identifier. The identifier [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** The chain of custody from a published safety eval [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: The proposed Three-Part Behavioral Trigger Sys [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

58 extracted references · 34 canonical work pages

[1]

2021 , eprint=

Did the Model Change? Efficiently Assessing Machine Learning API Shifts , author=. 2021 , eprint=

work page 2021
[2]

2025 , eprint=

Atlas: A Framework for ML Lifecycle Provenance & Transparency , author=. 2025 , eprint=

work page 2025
[3]

2026 , eprint=

Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies , author=. 2026 , eprint=

work page 2026
[4]

2024 , eprint=

A Safe Harbor for AI Evaluation and Red Teaming , author=. 2024 , eprint=

work page 2024
[5]

Regulation (EU) 2024/1689 (Artificial Intelligence Act) , year =

work page 2024
[6]

and Kwegyir-Aggrey, Kweku and Steed, Ryan and Rao, Anita K

Keller, Drew J. and Kwegyir-Aggrey, Kweku and Steed, Ryan and Rao, Anita K. and Sharp, Julia L. and Bergman, Stevie S. , title =. 2026 , month =. doi:10.6028/NIST.AI.800-3 , url =

work page doi:10.6028/nist.ai.800-3 2026
[7]

Model Cards for Model Reporting , url=

Mitchell, Margaret and Wu, Simone and Zaldivar, Andrew and Barnes, Parker and Vasserman, Lucy and Hutchinson, Ben and Spitzer, Elena and Raji, Inioluwa Deborah and Gebru, Timnit , year=. Model Cards for Model Reporting , url=. doi:10.1145/3287560.3287596 , booktitle=

arXiv
[8]

Partnership on AI , year=

Documenting the Impacts of Foundation Models , author=. Partnership on AI , year=

work page

Show all 58 references

[9]

2023 , eprint=

Deployment Corrections: An incident response framework for frontier AI models , author=. 2023 , eprint=

2023
[10]

2022 , eprint=

Learning New Skills after Deployment: Improving open-domain internet-driven dialogue with human feedback , author=. 2022 , eprint=

2022
[11]

2022 , eprint=

Training language models to follow instructions with human feedback , author=. 2022 , eprint=

2022
[12]

2025 , eprint=

Invisible Tokens, Visible Bills: The Urgent Need to Audit Hidden Operations in Opaque LLM Services , author=. 2025 , eprint=

2025
[13]

2026 , eprint=

Token-Efficient Change Detection in LLM APIs , author=. 2026 , eprint=

2026
[14]

2026 , eprint=

Log Probability Tracking of LLM APIs , author=. 2026 , eprint=

2026
[15]

2023 , eprint=

Towards Publicly Accountable Frontier LLMs: Building an External Scrutiny Ecosystem under the ASPIRE Framework , author=. 2023 , eprint=

2023
[16]

Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency , pages=

Model changelists: Characterizing updates to ml models , author=. Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency , pages=

2024
[17]

2025 , eprint=

Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs , author=. 2025 , eprint=

2025
[18]

Communications of the ACM , volume=

Datasheets for datasets , author=. Communications of the ACM , volume=. 2021 , publisher=

2021
[19]

Auditing large language models: a three-layered approach , volume=

Mökander, Jakob and Schuett, Jonas and Kirk, Hannah Rose and Floridi, Luciano , year=. Auditing large language models: a three-layered approach , volume=. AI and Ethics , publisher=. doi:10.1007/s43681-023-00289-2 , number=

doi
[20]

arXiv preprint arXiv:2504.13839 , year=

Audit cards: Contextualizing ai evaluations , author=. arXiv preprint arXiv:2504.13839 , year=

arXiv
[21]

Towards AI Accountability Infrastructure: Gaps and Opportunities in AI Audit Tooling , url=

Ojewale, Victor and Steed, Ryan and Vecchione, Briana and Birhane, Abeba and Raji, Inioluwa Deborah , year=. Towards AI Accountability Infrastructure: Gaps and Opportunities in AI Audit Tooling , url=. doi:10.1145/3706598.3713301 , booktitle=
[22]

arXiv preprint arXiv:2508.09853 , year=

STREAM (ChemBio): A standard for transparently reporting evaluations in AI model reports , author=. arXiv preprint arXiv:2508.09853 , year=

arXiv
[23]

Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education

Clancey, William J. Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education. Proceedings of the Eighth International Joint Conference on Artificial Intelligence (IJCAI-83)
[24]

Classification Problem Solving

Clancey, William J. Classification Problem Solving. Proceedings of the Fourth National Conference on Artificial Intelligence
[25]

, title =

Robinson, Arthur L. , title =. 1980 , doi =. https://science.sciencemag.org/content/208/4447/1019.full.pdf , journal =

1980
[26]

New Ways to Make Microcircuits Smaller---Duplicate Entry

Robinson, Arthur L. New Ways to Make Microcircuits Smaller---Duplicate Entry. Science
[27]

Clancey and Glenn Rennels , abstract =

Diane Warner Hasling and William J. Clancey and Glenn Rennels , abstract =. Strategic explanations for a diagnostic consultation system , journal =. 1984 , issn =. doi:https://doi.org/10.1016/S0020-7373(84)80003-6 , url =

1984 doi
[28]

and Rennels, Glenn R

Hasling, Diane Warner and Clancey, William J. and Rennels, Glenn R. and Test, Thomas. Strategic Explanations in Consultation---Duplicate. The International Journal of Man-Machine Studies
[29]

Poligon: A System for Parallel Problem Solving

Rice, James. Poligon: A System for Parallel Problem Solving
[30]

Transfer of Rule-Based Expertise through a Tutorial Dialogue

Clancey, William J. Transfer of Rule-Based Expertise through a Tutorial Dialogue
[31]

The Engineering of Qualitative Models

Clancey, William J. The Engineering of Qualitative Models
[32]

2017 , eprint=

Attention Is All You Need , author=. 2017 , eprint=

2017
[33]

Pluto: The 'Other' Red Planet

NASA. Pluto: The 'Other' Red Planet
[34]

European Union , year=

The eu artificial intelligence act , author=. European Union , year=
[35]

2025 , url =

General-Purpose. 2025 , url =

2025
[36]

arXiv preprint arXiv:2512.10169 , year =

The 2025 Foundation Model Transparency Index , author =. arXiv preprint arXiv:2512.10169 , year =

2025
[37]

Proceedings of the Conference on Fairness, Accountability, and Transparency (FAccT) , pages =

Mitchell, Margaret and Wu, Simone and Zaldivar, Andrew and Barnes, Parker and Vasserman, Lucy and Hutchinson, Ben and Spitzer, Elena and Raji, Inioluwa Deborah and Gebru, Timnit , title =. Proceedings of the Conference on Fairness, Accountability, and Transparency (FAccT) , pa...

2019
[38]

Journal of Artificial Intelligence Research (JAIR) , volume =

Gilbert, Thomas Krendl and Dean, Sarah and Zick, Nathan and Lambert, Nathan , title =. Journal of Artificial Intelligence Research (JAIR) , volume =. 2023 , doi =

2023
[39]

Assessing Language Model Deployment with Risk Cards , journal =

Derczynski, Leon and Kirk, Hannah Rose and Thukral, Shivani and R. Assessing Language Model Deployment with Risk Cards , journal =. 2023 , url =

2023
[40]

Harvard Data Science Review , volume =

Chen, Lingjiao and Zaharia, Matei and Zou, James , title =. Harvard Data Science Review , volume =. 2024 , doi =

2024
[41]

Proceedings of the International Conference on Learning Representations (ICLR) , year =

Mireshghallah, Niloofar and Rytting, Christopher Michael and Newman, Benjamin and Radford, Alec and Carter, Jasmine and Gleave, Adam , title =. Proceedings of the International Conference on Learning Representations (ICLR) , year =
[42]

Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (FAccT) , pages =

Raji, Inioluwa Deborah and Smart, Andrew and White, Rebecca and Mitchell, Margaret and Gebru, Timnit and Hutchinson, Ben and Smith-Loud, Jamila and Theron, Daniel and Barnes, Parker , title =. Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (FA...

2020
[43]

arXiv preprint arXiv:2304.14749 , year =

Cobbe, Jennifer and Veale, Michael and Singh, Jatinder , title =. arXiv preprint arXiv:2304.14749 , year =

arXiv
[44]

arXiv preprint arXiv:2401.14462 , year =

Birhane, Abeba and Steed, Ryan and Ojewale, Victor and Vecchione, Briana and Raji, Inioluwa Deborah , title =. arXiv preprint arXiv:2401.14462 , year =

arXiv
[45]

Big Data & Society , volume =

Widder, David Gray and Nafus, Dawn , title =. Big Data & Society , volume =. 2023 , doi =

2023
[46]

2024 , url =

DeepSeek-V2.5: A New Open-Source Model Combining General and Coding Capabilities , howpublished =. 2024 , url =

2024
[47]

2026 , url =

Model configuration , howpublished =. 2026 , url =

2026
[48]

2026 , url =

Model versions and lifecycle , howpublished =. 2026 , url =

2026
[49]

2025 , institution =

2025
[50]

2026 , howpublished =

Model. 2026 , howpublished =

2026
[51]

2026 , institution =

System. 2026 , institution =

2026
[52]

2026 , institution =

2026
[53]

2025 , howpublished =

Azure. 2025 , howpublished =

2025
[54]

2026 , howpublished =

Terms of Use , author =. 2026 , howpublished =

2026
[55]

Anthropic cracks down on unauthorized

Michael Nuñez , journal =. Anthropic cracks down on unauthorized. 2025 , month =

2025
[56]

Anthropic Revokes

Paresh Dave , journal =. Anthropic Revokes. 2025 , month =

2025
[57]

2026 , howpublished =

Terms of Service , author =. 2026 , howpublished =

2026
[58]

The Thirteenth International Conference on Learning Representations (ICLR) , year =

Gao, Irena and Liang, Percy and Guestrin, Carlos , title =. The Thirteenth International Conference on Learning Representations (ICLR) , year =

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

2021 , eprint=

Did the Model Change? Efficiently Assessing Machine Learning API Shifts , author=. 2021 , eprint=

work page 2021

[2] [2]

2025 , eprint=

Atlas: A Framework for ML Lifecycle Provenance & Transparency , author=. 2025 , eprint=

work page 2025

[3] [3]

2026 , eprint=

Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies , author=. 2026 , eprint=

work page 2026

[4] [4]

2024 , eprint=

A Safe Harbor for AI Evaluation and Red Teaming , author=. 2024 , eprint=

work page 2024

[5] [5]

Regulation (EU) 2024/1689 (Artificial Intelligence Act) , year =

work page 2024

[6] [6]

and Kwegyir-Aggrey, Kweku and Steed, Ryan and Rao, Anita K

Keller, Drew J. and Kwegyir-Aggrey, Kweku and Steed, Ryan and Rao, Anita K. and Sharp, Julia L. and Bergman, Stevie S. , title =. 2026 , month =. doi:10.6028/NIST.AI.800-3 , url =

work page doi:10.6028/nist.ai.800-3 2026

[7] [7]

Model Cards for Model Reporting , url=

Mitchell, Margaret and Wu, Simone and Zaldivar, Andrew and Barnes, Parker and Vasserman, Lucy and Hutchinson, Ben and Spitzer, Elena and Raji, Inioluwa Deborah and Gebru, Timnit , year=. Model Cards for Model Reporting , url=. doi:10.1145/3287560.3287596 , booktitle=

arXiv

[8] [8]

Partnership on AI , year=

Documenting the Impacts of Foundation Models , author=. Partnership on AI , year=

work page