ModelSeal: Verifying AI Model Files With SHA-256 and Arweave

Signup Write New Story ModelSeal: Verifying AI Model Files With SHA-256 and Arweave by Lawal Ridwan by Lawal Ridwan | @ lawalridwan Builder & web3 enthusiast based in Port Harcourt.

Builder & web3 enthusiast based in Port Harcourt.

Open-source AI models are downloaded millions of times from mirrors, torrents and re-uploads, but almost nobody checks whether the file they got is the file the author released. ModelSeal is a small open-source tool that fingerprints model files in the browser and anchors those fingerprints permanently on Arweave, so anyone can verify a model before they run it.

When you download a 4 GB model from a mirror, a Discord link or a re-upload, you are trusting that nobody changed a single byte along the way. That trust is rarely earned.

Model files are not just data. Some formats can carry executable code, and a quietly fine-tuned model can behave normally on most prompts while doing something harmful on others. Even with safe formats, a corrupted or swapped file means your results cannot be reproduced.

Centralised hubs help, but they are a single point of failure. Repos get deleted, accounts get banned, and files get replaced under the same name. If the original record disappears, there is nothing left to check against.

What open AI is missing is simple: a permanent, public, tamper-proof record of what each model file should look like.

Every file has a SHA-256 hash, a 64-character fingerprint. Change one byte and the fingerprint changes completely.

Because the manifest lives on Arweave, it is immutable and publicly readable indefinitely. Even if the original hub, repo or website goes away, the fingerprint remains.

Hashing: files are read in 8 MB chunks with file.slice() and fed into an incremental SHA-256 from the hash-wasm library, so multi-gigabyte model files don't have to fit in memory. If hash-wasm can't load, the app falls back to the Web Crypto API (crypto.subtle.digest) for files under 500 MB. On load, a self-test checks that the hash of "abc" equals the standard SHA-256 test vector and shows a warning if it doesn't.

Storage: manifests are tiny (well under 100 KB), so they can be published to Arweave for free through ArDrive. If the Wander wallet is installed, ModelSeal can also build and dispatch the Arweave transaction itself using arweave-js. Each manifest is tagged:

Lookup: the Verify tab queries the Arweave GraphQL endpoint (arweave.net/graphql) by these tags to find manifests, newest first, then fetches the JSON from arweave.net and compares hashes in the browser.

Why no server? Every step a server adds is another thing to trust and another thing that can go down. ModelSeal's only dependencies are the browser and the permaweb.

{ "app": "ModelSeal", "schema": "modelseal/1", "model": "name", "version": "v1.0", "licence": null, "author": null, "source": null, "sealedAt": "ISO-8601", "files": [ { "name": "model.safetensors", "size": 123, "sha256": "hex" } ] } How verification decides Match: the file's hash equals an entry in the manifest. It is byte-for-byte the file the author sealed. Mismatch: a file with the same name is in the manifest, but its fingerprint is different. Don't trust it. Unknown: the file is not part of this sealed model at all. Both hashes are shown side by side, so you can see exactly what was compared.

A fingerprint proves a file is unchanged since it was sealed. It does not prove the original model was safe, or that the sealer is the real author. Anyone can seal a manifest under any name, so the next step is linking manifests to a verified author identity, such as a wallet signature that authors publish on their official page.

Decentralised AI only works if people can trust what they run without trusting one company. Decentralised compute tells you where a model runs. Permanent storage tells you what was released. ModelSeal connects the two with something simple: a fingerprint nobody can delete.

If you publish open models, seal them. If you download them, verify them.

ModelProof: Proving an AI Model Hasn't Been Tampered With, Stored Forever on Arweave