Merkle-Anchored Model Weight Release and RATS-Attested Runtime Activation Binding for Edge and Cloud AI Fleets
draft-durga-scitt-model-activation-binding-00
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Author | Raghuvar Karthik Durga | ||
| Last updated | 2026-11-02 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-durga-scitt-model-activation-binding-00
SCITT / RATS Working Group R. K. Durga
Internet-Draft Microsoft Corporation
Intended status: Standards Track 2 November 2026
Expires: 6 May 2027
Merkle-Anchored Model Weight Release and RATS-Attested Runtime
Activation Binding for Edge and Cloud AI Fleets
draft-durga-scitt-model-activation-binding-00
Abstract
Supply Chain Integrity, Transparency, and Trust (SCITT) provides
transparent artifact statements, and Remote Attestation Procedures
(RATS, RFC 9334) provide hardware/runtime attestation evidence.
However, no existing internet standard defines an atomic
cryptographic binding between a chunked AI model weight release
manifest, a hardware-monotonic anti-rollback epoch counter, and a
live RATS attestation result at the moment model weights are mapped
into accelerator memory. This document specifies the Model
Activation Binding Token (MABT) protocol, preventing load-time weight
substitution, silent quantization downgrade, and rollback attacks
across cloud and edge AI inference fleets.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 6 May 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
Durga Expires 6 May 2027 [Page 1]
Internet-Draft Merkle Model Activation Binding November 2026
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction and Problem Statement . . . . . . . . . . . . . 2
2. Conventions and Definitions . . . . . . . . . . . . . . . . . 2
3. Model Activation Binding Token (MABT) Structure . . . . . . . 3
4. Normative Fail-Closed Verification Rules . . . . . . . . . . 3
5. Strict Parser Determinism and Wire-Level Input Hardening . . 4
6. Implementation Status and Empirical Benchmark Evaluation . . 4
7. Security Considerations . . . . . . . . . . . . . . . . . . . 5
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6
9. Normative References . . . . . . . . . . . . . . . . . . . . 6
10. Informative References . . . . . . . . . . . . . . . . . . . 6
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 8
1. Introduction and Problem Statement
AI model weights (GGUF, Safetensors, ONNX) are multi-gigabyte
artifacts loaded dynamically by agent runtimes. Standard container
image signing verifies the container binary at boot, but does not
cryptographically bind the active model tensor chunks, LoRA adapter
layers, and quantization profile in GPU/NPU memory to a SCITT
transparency receipt and a RATS hardware nonce during inference
execution.
This specification complements the foundational execution-trace
verification architecture defined in draft-durga-agenttrust-trace-
verification-00 by introducing deterministic, fail-closed wire
semantics specifically addressing Merkle Model Activation Binding.
2. Conventions and Definitions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 ([RFC2119] [RFC8174]) when, and only when, they appear in all
capitals, as shown here.
Durga Expires 6 May 2027 [Page 2]
Internet-Draft Merkle Model Activation Binding November 2026
3. Model Activation Binding Token (MABT) Structure
Prior to serving inference requests for a governed agent workflow,
the inference runtime MUST generate and register a COSE_Sign1 or JCS-
canonicalized Model Activation Binding Token (MABT):
{
"mabt_version": "1.0",
"workload_id": "spiffe://example.org/ns/prod/sa/agent-inference-node-04",
"weight_merkle_root": "sha256:6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b",
"manifest_meta": {
"chunk_size_bytes": 4194304,
"total_byte_length": 16106127360,
"quantization_profile": "FP16_STRICT"
},
"anti_rollback_security_epoch": 42,
"rats_eat_attestation_hash": "sha256:d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35",
"scitt_transparency_receipt_ref": "sha256:4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce",
"activation_nonce": "9f86d081884c7d659a2feaa0c55ad015",
"exp": 1793491200,
"signature": {
"alg": "Ed25519",
"kid": "sha256:b600306cfa76723fdec395e53a9b3d9fdb78b1e2d7a23c32fcbcd2dc6d0c4092",
"sig": "b3cCTQWySKBHRIbG2jPGHgJXcAsxYhAXLZ6sYdn_vhQrhViPT48ZRjLk-yG3N0A1Aj-XDJspWC6eT4jryzLYAA"
}
}
4. Normative Fail-Closed Verification Rules
Conforming verifiers and relying-party gateways MUST enforce the
following deterministic invariants before releasing any downstream
side effect:
1. CHUNKED_WEIGHT_MERKLE_VERIFICATION: The weight_merkle_root MUST
be computed as a binary Merkle tree (RFC 9162 style domain
separation: 0x00 for leaves, 0x01 for internal nodes) over
ordered, fixed-size tensor chunks prior to DMA transfer into
accelerator memory.
2. ANTI_ROLLBACK_EPOCH_ENFORCEMENT: Conforming verifiers MUST reject
any MABT whose anti_rollback_security_epoch is strictly less than
the minimum security epoch persisted in hardware NVRAM or the
fleet policy ledger.
3. RATS_NONCE_FRESHNESS: The rats_eat_attestation_hash MUST bind the
runtime's hardware measurement, weight_merkle_root, and
activation_nonce so replayed attestations from prior boot cycles
fail closed.
Durga Expires 6 May 2027 [Page 3]
Internet-Draft Merkle Model Activation Binding November 2026
5. Strict Parser Determinism and Wire-Level Input Hardening
Cross-language interoperability testing across Rust and Python
attestation verifiers demonstrates that standard RFC 8785 JCS
canonicalization is necessary but insufficient if the outer JSON/CBOR
parser silently coerces malformed inputs prior to canonicalization.
Conforming MABT verifiers MUST enforce five pre-canonicalization
parser invariants:
1. DUPLICATE_KEY_REJECTION: The JSON parser MUST reject any MABT
object or nested manifest_meta map containing duplicate member
names at the lexer/object-pairs hook prior to dictionary
construction, preventing last-key-wins shadow payload attacks.
2. IEEE754_FINITE_SAFE_INTEGER_BOUNDS: All integer fields
(chunk_size_bytes, total_byte_length,
anti_rollback_security_epoch, exp) MUST be exact JSON integers
within the IEEE-754 safe integer range [-(2^53 - 1), +(2^53 -
1)]. Boolean literals (true/false), fractional numbers, and non-
finite constants (NaN, Infinity, -Infinity, or exponent-overflow
tokens such as 1e1000) MUST be rejected immediately.
3. CANONICAL_LOWERCASE_HEX_DIGESTS: All sha256:-prefixed digest
fields (weight_merkle_root, rats_eat_attestation_hash,
scitt_transparency_receipt_ref, kid) MUST consist of the literal
lowercase prefix sha256: followed by exactly 64 lowercase ASCII
hexadecimal characters ([0-9a-f]{64}).
4. MINIMAL_BASE64URL_AND_PUBLIC_JWK_HYGIENE: The sig field MUST be
unpadded RFC 4648 Section 5 Base64url with zero non-zero trailing
pad bits. Any embedded or referenced JWK key material MUST
reject private key parameters (d, p, q, dp, dq, qi, oth, k) and
non-minimal Base64urlUInt RSA exponents.
5. EVIDENCE_TO_RULE_BYTE_BINDING: When a MABT is cited as an
evidence item inside an external Verdict Record
([I-D.wright-verdict-record]), the verifier rule evaluation MUST
bind directly to the digest-verified MABT envelope bytes rather
than unverified summary copies in the outer claim body.
6. Implementation Status and Empirical Benchmark Evaluation
The normative mechanisms and strict parser hardening rules specified
in this document have been implemented and evaluated across open-
source reference verifiers and production attestation pipelines:
Durga Expires 6 May 2027 [Page 4]
Internet-Draft Merkle Model Activation Binding November 2026
* Open-Source Attestation & Custody Verifiers: Production verifier
hardening for AMD SEV-SNP VCEK/ASK chains, Intel TDX Quote v4,
NVIDIA NRAS EAR appraisal, Azure CVM HCL HCLAkPub JWK validation,
and RFC 9162 Merkle weight-custody proofs is implemented in the
agentrust-io/cmcp, agentrust-io/weight-custody-manifest, and
agentrust-io/trace-spec verifier suites
([AGENTIC-GOV-BENCHMARKS]).
* Core Rust Evidence Engine: Deterministic RFC 8785 JCS evidence
digesting (TraceEvidenceReport) and pinned citation verification
are implemented in Rust in xerj-org/xerj (engine/crates/xerj-
common/src/hub_evidence.rs, [XERJ-HUB-EVIDENCE]).
* Empirical Benchmark Results: Evaluated against the 100-scenario
OWASP ASI01-ASI10 Enterprise Agentic AI Security Regression
Benchmark ([OWASP-ASI-BENCHMARK-DOI]) and the companion Technical
Report ([ZENODO-TR-2026-01]), two-layer Merkle weight-release
verification and tri-anchor hardware lease enforcement detect 100%
of weight-chunk tampering, quantization downgrades, and epoch
rollback attempts with sub-millisecond verification overhead.
7. Security Considerations
All pre-image objects MUST be canonicalized using RFC 8785 JSON
Canonicalization Scheme (JCS) prior to signature generation or
verification under RFC 8032 Ed25519. Any clock skew exceeding 60
seconds, digest mismatch, or missing cryptographic binding MUST cause
the verifier to fail closed and emit an auditable security rejection
receipt. For the normative test vector in Section 3, the Ed25519
test key seed is 2a2a...2a (32 bytes of 0x2a), yielding raw 32-byte
public key
197f6b23e16c8532c6abc838facd5ea789be0c76b2920334039bfa8b3d368d61 (kid
=
sha256:b600306cfa76723fdec395e53a9b3d9fdb78b1e2d7a23c32fcbcd2dc6d0c4092),
and the full RFC 8785 JCS-canonicalized envelope (822 bytes) hashes
to SHA-256
f12feb5bf217115ee22b4e82b9da13de2497000fddd248ebeaec6d4969b405c1.
This specification cross-references the companion Internet-Drafts
([I-D.durga-agenttrust-trace-verification],
[I-D.durga-wimse-ctx-isolation],
[I-D.durga-pquip-pqc-agentic-delegation],
[I-D.durga-agent-tx-compensation-lease]), external Verdict Record
evidence binding ([I-D.wright-verdict-record]), Remote Attestation
([RFC9334]), Merkle Tree domain separation ([RFC9162]), and the
100-scenario OWASP ASI01-ASI10 benchmark ([OWASP-ASI-BENCHMARK-DOI]).
Durga Expires 6 May 2027 [Page 5]
Internet-Draft Merkle Model Activation Binding November 2026
8. IANA Considerations
This document requests IANA registration of the media type
application/mabt-activation+json and the registry IETF Model
Activation Verification Profiles, alongside the following header
fields:
* HTTP/MCP Header Field: Agent-Model-Activation-Binding
9. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, May 2017,
<https://www.rfc-editor.org/info/rfc8174>.
[RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON
Canonicalization Scheme (JCS)", RFC 8785, June 2020,
<https://www.rfc-editor.org/info/rfc8785>.
[RFC8032] Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital
Signature Algorithm (EdDSA)", RFC 8032, January 2017,
<https://www.rfc-editor.org/info/rfc8032>.
10. Informative References
[RFC9162] Laurie, B., Messeri, E., and R. Stradling, "Certificate
Transparency Version 2.0", RFC 9162, December 2021,
<https://www.rfc-editor.org/info/rfc9162>.
[RFC9334] Birkholz, H., Thaler, D., Richardson, M., Smith, N., and
W. Pan, "Remote ATtestation procedureS (RATS)
Architecture", RFC 9334, January 2023,
<https://www.rfc-editor.org/info/rfc9334>.
[I-D.durga-agenttrust-trace-verification]
Durga, R. K., "Cryptographic Execution-Trace Verification,
JCS Canonicalization, and Fail-Closed Delegation Chains
for Autonomous AI Agents", Work in Progress, Internet-
Draft, draft-durga-agenttrust-trace-verification-00,
October 2026, <https://datatracker.ietf.org/doc/html/
draft-durga-agenttrust-trace-verification-00>.
Durga Expires 6 May 2027 [Page 6]
Internet-Draft Merkle Model Activation Binding November 2026
[I-D.durga-wimse-ctx-isolation]
Durga, R. K., "Cryptographic Context Isolation and
Instruction-Data Plane Separation for Autonomous Agent
Tool Invocations", Work in Progress, Internet-Draft,
draft-durga-wimse-ctx-isolation-00, October 2026,
<https://datatracker.ietf.org/doc/html/draft-durga-wimse-
ctx-isolation-00>.
[I-D.durga-pquip-pqc-agentic-delegation]
Durga, R. K., "Post-Quantum Hybrid Cryptographic
Delegation Chains and Merkle-Aggregated Execution Receipts
for Autonomous AI Agents", Work in Progress, Internet-
Draft, draft-durga-pquip-pqc-agentic-delegation-00,
October 2026, <https://datatracker.ietf.org/doc/html/
draft-durga-pquip-pqc-agentic-delegation-00>.
[I-D.durga-agent-tx-compensation-lease]
Durga, R. K., "Pre-Release Transactional Compensation
Leases and CAS Fencing Receipts for Autonomous Agents Over
Systems of Record", Work in Progress, Internet-Draft,
draft-durga-agent-tx-compensation-lease-00, November 2026,
<https://datatracker.ietf.org/doc/html/draft-durga-agent-
tx-compensation-lease-00>.
[I-D.wright-verdict-record]
Wright, D., "Verdict Records: Results on Claims that Cite
Receipts as Evidence", Work in Progress, Internet-Draft,
draft-wright-verdict-record-01, November 2026,
<https://datatracker.ietf.org/doc/html/draft-wright-
verdict-record-01>.
[OWASP-ASI-BENCHMARK-DOI]
Durga, R. K., "OWASP ASI01-ASI10 Enterprise Agentic AI
Security Regression Benchmark Dataset (N=100 Scenarios)",
DOI 10.57967/hf/11352, October 2026,
<https://doi.org/10.57967/hf/11352>.
[XERJ-HUB-EVIDENCE]
Durga, R. K., "XERJ Common Rust Engine: Deterministic JCS
TraceEvidenceReport, PinnedCitation, and Isotonic
Confidence Verification", GitHub xerj-org/xerj#2857,
November 2026,
<https://github.com/xerj-org/xerj/pull/2857>.
Durga Expires 6 May 2027 [Page 7]
Internet-Draft Merkle Model Activation Binding November 2026
[AGENTIC-GOV-BENCHMARKS]
Durga, R. K., "Enterprise Agentic Governance Benchmarks
and Reference Verifier Suite v1.0.0", Version 1.0.0,
November 2026, <https://github.com/drk-ram/enterprise-
agentic-governance-benchmarks/releases/tag/v1.0.0>.
[ZENODO-TR-2026-01]
Durga, R. K., "Cryptographic Model Weight Release,
Hardware Anti-Rollback Leases, and RATS-Attested
Activation Binding for Edge AI Fleets",
DOI 10.5281/zenodo.23735274, October 2026,
<https://doi.org/10.5281/zenodo.23735274>.
Author's Address
Raghuvar Karthik Durga
Microsoft Corporation
United States of America
Email: rdurga@microsoft.com
Durga Expires 6 May 2027 [Page 8]