ModelSeal: Verifying AI Model Files With SHA-256 and Arweave

Open-source AI models are downloaded millions of times from mirrors, torrents and re-uploads, but almost nobody checks whether the file they got is the file the author released. ModelSeal is a small open-source tool that fingerprints model files in the browser and anchors those fingerprints permanently on Arweave, so anyone can verify a model before they run it. The problem: we trust model files blindly When you download a 4 GB model from a mirror, a Discord link or a re-upload, you are trusting that nobody changed a single byte along the way. That trust is rarely earned. Model files are not just data. Some formats can carry executable code, and a quietly fine-tuned model can behave normally on most prompts while doing something harmful on others. Even with safe formats, a corrupted or swapped file means your results cannot be reproduced. Centralised hubs help, but they are a single point of failure. Repos get deleted, accounts get banned, and files get replaced under the same name. If the original record disappears, there is nothing left to check against. What open AI is missing is simple: a permanent, public, tamper-proof record of what each model file should look like. The idea: a fingerprint that can't be deleted Every file has a SHA-256 hash, a 64-character fingerprint. Change one byte and the fingerprint changes completely. ModelSeal does two things: Seal. A model author drops their model files into the browser. ModelSeal computes the SHA-256 of each file locally (nothing is uploaded) and builds a small JSON manifest: model name, version, licence, author, source URL, file names, sizes and hashes. The author publishes that manifest to Arweave, tagged so it can be found later. Verify. Anyone who downloaded the model opens the Verify tab, loads the manifest (by Arweave transaction ID, by searching the model name, or by pasting the JSON), and drops in their file. ModelSeal hashes it locally and compares it with the permanent record. The result is one of three: Match, Mismatch or Unknown. Because the manifest lives on Arweave, it is immutable and publicly readable indefinitely. Even if the original hub, repo or website goes away, the fingerprint remains. Architecture Frontend: a single static page in plain HTML, CSS and JavaScript, with no build step and no backend server. It is hosted on GitHub Pages, but it runs anywhere you can open an HTML file. Hashing: files are read in 8 MB chunks with file.slice() and fed into an incremental SHA-256 from the hash-wasm library, so multi-gigabyte model files don't have to fit in memory. If hash-wasm can't load, the app falls back to the Web Crypto API (crypto.subtle.digest) for files under 500 MB. On load, a self-test checks that the hash of "abc" equals the standard SHA-256 test vector and shows a warning if it doesn't. Storage: manifests are tiny (well under 100 KB), so they can be published to Arweave for free through ArDrive. If the Wander wallet is installed, ModelSeal can also build and dispatch the Arweave transaction itself using arweave-js. Each manifest is tagged: App-Name: ModelSeal Model-Name: (model name) Model-Version: (version) Content-Type: application/json Lookup: the Verify tab queries the Arweave GraphQL endpoint (arweave.net/graphql) by these tags to find manifests, newest first, then fetches the JSON from arweave.net and compares hashes in the browser. Why no server? Every step a server adds is another thing to trust and another thing that can go down. ModelSeal's only dependencies are the browser and the permaweb. Manifest format (modelseal/1) { "app": "ModelSeal", "schema": "modelseal/1", "model": "name", "version": "v1.0", "licence": null, "author": null, "source": null, "sealedAt": "ISO-8601", "files": [ { "name": "model.safetensors", "size": 123, "sha256": "hex" } ] } How verification decides Match: the file's hash equals an entry in the manifest. It is byte-for-byte the file the author sealed. Mismatch: a file with the same name is in the manifest, but its fingerprint is different. Don't trust it. Unknown: the file is not part of this sealed model at all. Both hashes are shown side by side, so you can see exactly what was compared. Design lessons Hashing huge files in a browser needs streaming. Reading a whole multi-gigabyte file into one buffer is the fastest way to crash a tab, so chunked, incremental hashing is not optional. Tag design is the index. With good Arweave tags, manifests can be found through GraphQL without running any index server of my own. Plan for the sandbox. Downloads and wallet extensions are not always available, so the manifest is also shown in a text box with a Copy JSON button, and every network step has a friendly error. Limitations A fingerprint proves a file is unchanged since it was sealed. It does not prove the original model was safe, or that the sealer is the real author. Anyone can seal a manifest under any name, so the next step is linking manifests to a verified author identity, such as a wallet signature that authors publish on their official page. Roadmap Author signatures, so manifests can be tied to a known publisher wallet. A command-line tool, so you can run modelseal verify ./model.safetensors from a terminal. Dataset sealing, using the same flow for training datasets, to support reproducible AI. Running inference only on verified files, for example on decentralised GPU networks like Nosana, so a compute job can prove which exact model it ran. Why this matters for decentralised AI Decentralised AI only works if people can trust what they run without trusting one company. Decentralised compute tells you where a model runs. Permanent storage tells you what was released. ModelSeal connects the two with something simple: a fingerprint nobody can delete. If you publish open models, seal them. If you download them, verify them. Live demo. Code.