Why this analysis has no ERS
This brief reports a controlled research result about a training-time mechanism, not an incident against a deployed AI system. The teacher and student models were created by the researchers to demonstrate the effect; there is no victim deployment, no operator, no production configuration, and no attack against a running system. Consequently the three AITBM layers have no referent: the IVP would have to be scored against a research artefact rather than an assessed configuration, and every ORP dimension - autonomy, attack surface, cascade potential, remediation feasibility - would have to be invented, since a distillation pipeline demonstrated in a laboratory has no deployment context to score. The protocol's representative-configuration exception does not rescue it either: the brief studies a class of training pipeline, not a class of deployment, and it supplies no configuration facts (autonomy, exposure, downstream reach) from which a representative deployment could be reconstructed. Scoring it would manufacture numbers the evidence cannot support. The brief is nonetheless directly useful to AITBM as a scoping input, recorded in key_finding below.
Classification: Research · source date 2026-04-16
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-002.001 | Data & Artifact VersioningParent AID-M-002 (Data, Artifact & Knowledge Provenance, Integrity & Risk Characterization). Versioned manifests recording which model generated a synthetic corpus, from which base, and which training run consumed it are Tr-4 lineage evidence and Ro-4 ingestion-provenance evidence in any future assessment of a distillation pipeline. | Very High | Fa-3 Pr-3 Ro-4 Tr-3 Tr-4 |
| AID-H-003.006 | Model SBOM & Provenance AttestationParent AID-H-003 (Secure ML Supply Chain Management). Because transfer depends on shared or behaviourally matched initialisation, signed base-model and tokenizer ancestry is the one machine-checkable predictor - squarely Tr-4 lineage disclosure feeding an Ro-4 admission decision. | Very High | Ro-4 Tr-4 |
| AID-H-007.006 | Post-Training Optimization & Format-Conversion Safety RegressionParent AID-H-007 (Secure Training & Evaluation Pipeline Integrity). Binding the distilled student to its approved source model, teacher, corpus and digest, then comparing both on a signed suite with explicit trait-transfer probes, is the promotion gate an Ro-4 score above 0.50 would require. | High | Ro-4 |
| AID-H-003.003 | External Dataset Supply-Chain Provenance AdmissionParent AID-H-003. Admission turning on verified generating-model identity and base-model lineage rather than on measured content is precisely the Ro-4 'provenance checks and quarantine' criterion, and it is the only form of the control the paper's result leaves standing. | High | Ro-4 Tr-4 |
| AID-H-007.004 | Evaluation Data Integrity, Sufficiency Assurance & Promotion GovernanceParent AID-H-007. The paper's demonstration that ICL and LLM-judge probes missed the trait is direct evidence that a promotion gate resting on standard benchmarks does not support a high Ro-4 anchor; post-fine-tune trait regression probes against the pre-fine-tune baseline are required. | Medium | Ro-4 |