TensorGuard-Lite: Auditing Sovereign AI Claims Through Gradient-Based Model Provenance

The idea is pretty original! provenance fingerprinting as an enforcement lever tied to state compute. And you ran it which shows well. Recovering the known DeepSeek/Qwen lineage on a T4 (cosine 0.980, vocab Jaccard 0.9999) is a real, reproducible result. Where it thins out is validation. Four models and one known derivative is not enough to bound false positives, and your own numbers prove the risk: SmolLM2's cosine to Qwen (0.997) beats the actual derivative's (0.980), so ranking on cosine alone mislabels it. Widen the panel, add several known derivatives, report false-positive rates. Lead with the cleaner Jaccard signal and treat gradient cosine as backup. And since white-box access is the thing sovereign vendors will not give you, the compute-conditional disclosure policy is your real contribution, so build that out. Promising, and the policy framing is the part to chase.

Creative application of gradient fingerprinting. The Tamil Token Tax finding is striking enough that it deserves more than a subsection. I think it's arguably the most immediately actionable finding for policymakers deciding whether to mandate indigenous tokenizers as a condition of compute subsidy. You may consider addressing the paper's fundamental tension more directly: that gradient fingerprinting requires white-box weight access, but the models most urgently needing audit are precisely those refusing to release weights. Could be by proposing either black-box behavioral fingerprinting alternatives or specific legal mechanisms that would compel regulator-level weight access as a condition of receiving state compute.

Adapting gradient-based fingerprinting to the open-washing problem is a sharp framing, and the system behind it is real: a deterministic 2,097-line Colab pipeline, a 16-dimensional fingerprint, and an unusually clean two-signal result, where DeepSeek-R1-Distill-Qwen lands at cosine 0.980 to its Qwen parent and a near-perfect 0.9999 tokenizer-vocabulary Jaccard corroborates the lineage independently. The limitations are honest, naming false positives on similar architectures, the twelve-sentence corpus, and the ≤3B ceiling. Validation is the soft spot. The one positive pair is a known distill, and the threshold (cosine ≥0.92) is set to pass exactly that pair, so the discriminator rests on n=1; SmolLM2's 0.997 cosine to Qwen — higher than the true derivative's — is a near-false-positive that only Euclidean distance rescues, which is fragile. More fundamentally, the method needs white-box weights, yet the sovereign models it targets are API-only and self-classify as UNVERIFIABLE, so the tool works where it is least needed and cannot reach where it is most needed. An external set of genuinely open-washed models, with a measured false-positive rate across unrelated same-architecture pairs, is what would make this a detector rather than a demonstration.