AI/ML review
We review pipelines, artifacts, agents, inference, and capability. We do not sell a governance PDF for a chatbot.
System, not model
The model is one artifact. The system is the weights, the tokenizer and config that load them, the serving code, the retrieval store, the tool surface, the memory, the orchestration loop, the evals that claim it is safe, and the keys and humans around all of it. A weights-only review is a different job.
We ask what the system can do that matters: sign, spend, deploy, delete, read data it should not. Then we trace every path from untrusted input to that action. Most findings live in the loader, the tool schema, and the loop. A pickle can execute on load while the architecture slide still says “weights only.”
Artifacts and tool-calling
- Model files. Pickle-based checkpoints execute code on load. A safetensors file does not. We review the format, the loader, the custom ops and kernels that ship beside the weights, and the hub or bucket they come from.
- Provenance. Which weights are actually running. Whether the hash matches the one that was evaluated. Who can push a new revision to the path the server loads from.
- Tool schemas. Who may call which tool with which arguments. Whether arguments are validated as untrusted input. Which calls require a confirmation the model cannot supply for itself.
- Retrieval as an authorization channel. A document that says “approved” is data. We look for paths where retrieved text changes a decision the policy should own.
- Memory. What persists across sessions and users. Who can write to it. Whether a poisoned entry becomes a standing instruction.
- Evals. When an eval is cited as a safety property, we review the harness. Does it grade itself? Did test data leak into training? What the number can and cannot support.
Failure modes we review
- Prompt injection, direct and indirect, that reaches a tool call with side effects: a web page, a ticket, a calendar invite, a repository file.
- The model reads a tool result that says it may proceed, and proceeds. Authorization by accident.
- Over-broad tool scopes. One credential for read and write, one key for staging and production, one agent identity for every user.
- Deserialization and code execution from model artifacts, plugins, and extensions loaded at runtime.
- Retrieval and memory poisoning that sticks. One injected message changes every later session.
- Secrets in the context window: API keys, other tenants' data, and the full system prompt echoed back on request.
- Unbounded loops and consumption. No cap on recursion depth, tokens, tool calls, or spend, so a crafted input becomes a bill or an outage.
- Inference and orchestration servers exposed without authentication, admin endpoints on the same port as the model, debug modes left on.
- Multi-agent handoffs. One agent's output is the next agent's instruction, and no policy sits between them.
What this is not
- Governance memos, responsible-AI frameworks, regulatory checklists. We can point you to people who do that work.
- Jailbreak contests and generic chatbot pentests belong elsewhere. Making a model say something rude is not a finding unless the model can then do something.
- Bias and fairness work is a real discipline with its own methods. Hire that practice for that question.
- Content-policy red teams look at what the system will say. We review what it can do.
- A model that touches nothing is not a system under test. No key, no fund, no deployment, no reachable data: we will say so and stop.
Request a scoping call
Tell us where the weights come from, what the agent can call, and what it can touch that matters: keys, funds, production data. If there is no system under test, there is nothing for us to review.