MSAF: Model State Attestation Framework — Evidence-Based Governance for Foundation Models

Abstract

The Model State Attestation Framework (MSAF) is the theoretical foundation of the Auburn Governance Stack. It establishes the intellectual authority for why cryptographic AI attestation is necessary, defines the three-tier attestation architecture, surveys over 200 papers from 2022 through 2026 confirming that no existing system composes hardware trust, continuous model health monitoring, and supply chain provenance into a unified attestation artifact, and documents the theoretical ceilings that bound what attestation can and cannot guarantee. The framework addresses a fundamental governance paradox: organizations deploying foundation models into critical infrastructure cannot definitively demonstrate that a specific output was generated by a model version in a compliant internal state. Current governance artifacts including model cards, training logs, and static benchmarks are descriptive rather than prescriptive and fundamentally non-verifiable. MSAF composes three verification tiers into a layered architecture. The first tier provides TEE-backed platform attestation for execution environment integrity, proving the silicon is real and uncompromised. The second tier provides signed continuous metrics for training and inference health monitoring, proving the model is healthy at the moment of inference. The third tier provides selective zero-knowledge proofs for high-value inference verification, enabling verification without exposing proprietary model internals. The composed attestation artifact is mapped to specific evidence requirements across five regulatory frameworks: EU AI Act Articles 11 and 15, FDA Software as a Medical Device Pre-Determined Change Control Plans, Federal Reserve SR 11-7 ongoing monitoring requirements, US Federal Procurement mandates, and AI insurance underwriting. The framework identifies the theoretical ceilings that bound attestation: Rice's theorem establishing the undecidability of semantic properties, the Impossibility Sandwich bounding what verification can achieve between Rice's theorem and Gödel's incompleteness, and TEE physical side-channel vulnerabilities limiting hardware trust guarantees. The honest framing: MSAF provides probabilistic risk reduction and accountability infrastructure, not behavioral safety guarantees. This is analogous to financial auditing, which certifies process compliance without guaranteeing future solvency. The building blocks exist individually. MSAF is the composition that binds them into an enforceable governance architecture. This work was previously hosted on Figshare, where the author maintained a portfolio of 29 publications with minted DOIs and an established ORCID record. The author's Figshare account was disabled without prior notice, without citation of a specific terms violation, and without opportunity for review, rendering all published items and their associated DOIs inaccessible. No communication was provided before or at the time of the disable action. This deposit and associated deposits on Zenodo ensure continued public accessibility of the author's research on institutional infrastructure with appropriate permanence guarantees.