Apoorve Bhargava

Beyond Detection: A Recovery-Oriented Architecture for Compromised AI Model Remediation

Preprint · September 2026 · CC BY 4.0 · 16 pages

AI supply chain security has matured at the point of adoption: model signing, provenance documentation and static scanning all answer whether an artifact is what it claims to be. None answers the question that arises when that trust is later overturned — given an artifact now known to be compromised, which deployed models descend from it, and what can be done about each one.

The paper argues this is a graph reachability problem rather than a cryptographic one, gives a formal model of how compromise propagates across a typed lineage graph, and builds a recovery planner that classifies every affected artifact by whether rollback to a clean, signed ancestor is actually available.

• Two proofs. A blast radius computed over an incompletely recorded graph is a sound lower bound on true exposure, so the query never over-reports; and any rollback target the planner proposes lies outside the true blast radius, even though the planner never sees that graph.
• Partial records mislead in a measurable way. The rate at which artifacts are wrongly declared unrecoverable grows superlinearly in the detection miss rate, while the count grows sublinearly — so claims about operational cost are claims about the count, not the rate.
• Attestation coverage is a poor security metric. An adversary who withholds attestations near the compromise, rather than losing them at random, halves recall at an identical recording budget.