model weights

Encryption at rest is the easy part; weights must be decrypted somewhere to be used. The scored answer controls where decryption happens, who can cause it, and how fast misuse is noticed.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.

The people who build frontier models need access to them, which is exactly the risk. The scored answer reduces who can touch weights directly, makes exfiltration hard and visible, and does it without poisoning research culture.

A framework that ties security investment to attacker capability. The scored answer explains the five levels, why the top ones are qualitatively different, and how labs use the idea.

Weights pass through more systems than most teams draw. The scored answer maps every hop, asks what an attacker could steal or swap at each, and puts integrity checks where they cannot be skipped.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.