Warden Documentation
Everything you need to understand, audit, and monitor open-weight and closed-weight AI models using the Warden platform. Use the Contents menu to jump to any section.
What is Warden?
Warden is a model trust console — a platform that lets security teams, ML engineers, and compliance officers verify the integrity of open-weight AI models before they enter an organisation's infrastructure. It answers one question: can we deploy this model safely?
Warden performs three classes of analysis on every model it audits:
| Layer | What it checks | Output |
|---|---|---|
| Static analysis | Binary opcode scan, pickle GLOBAL/REDUCE tracking, safetensors overlay, byte coverage | Threat flags + clean/suspicious verdict |
| Merkle integrity | Cryptographic hash tree over all weight shards, compared to published HuggingFace digests | Root hash, drift status, tamper evidence |
| Dynamic analysis | Behavioral sandbox probes — 16 TTP categories derived from the CrowdStrike taxonomy | Per-category pass/fail, GO/CAUTION/NO-GO verdict |
How it works
- 1
Paste any model ID or URL
Enter a HuggingFace model ID, a direct URL, or a model name from any of the 40+ supported registries and providers. Warden classifies the source type automatically.
- 2
Source classification
Warden determines the source type: open-source, open-weight, closed-first-party (e.g. OpenAI, Anthropic, GLM), hosted-inference, private-finetune, or unknown. The badge appears next to the model header.
- 3
3D architecture render
Warden fetches the model card and renders a real transformer architecture diagram in 3D — layers, attention heads, residual paths.
- 4
Weight index + Merkle tree
For open-weight models: all weight shards are indexed; a Merkle tree is computed over shard digests and compared to the published HuggingFace manifest. Closed-weight models skip this step.
- 5
Static analysis
For open-weight models: each shard is scanned for malicious opcodes, unsafe pickle patterns, and known-bad signatures. Closed-weight models show a behavioral-only notice here.
- 6
Dynamic behavioral probes
The model is loaded and probed across 16+ behavioral categories. Pro/Enterprise: auto-fires on page load. Free tier: manual trigger required. Anonymous: requires sign-in.
- 7
Verdict
A GO / CAUTION / NO-GO verdict is generated with a company-readiness rationale you can share with a procurement or security committee.
The threat model
Open-weight models carry a unique supply chain risk: they are large binary blobs distributed through a small number of registries (primarily HuggingFace) and executed with deep system access at inference time.
Warden's TTP taxonomy covers 16 attack categories:
| Code | Category | Example threat |
|---|---|---|
| INJ | Prompt injection | Instruction override in system context |
| EXF | Data exfiltration | Covert channel in model output stream |
| PII | PII leakage | Training data memorisation exposed in outputs |
| BWD | Backdoor | Trigger-activated behaviour change |
| ADV | Adversarial robustness | Targeted misclassification under perturbation |
| HAL | Hallucination | Confident fabrication of factual claims |
| TOX | Toxicity | Unprompted harmful content generation |
| BIA | Bias | Systematic skew in demographic or factual outputs |
| REF | Refusal bypass | Safety guardrail circumvention |
| HIS | Historical integrity | Factual distortion of documented historical events |
| REL | Religious sensitivity | Unprompted polarised religious framing |
| POL | Political influence | Electoral or political opinion manipulation |
| MED | Medical safety | Dangerous health advice without qualification |
| LEG | Legal safety | Advice that could constitute unauthorised legal practice |
| CYB | Cyberweapon | Code generation for offensive security tools |
| TCL | Tool call integrity | Malicious or unauthorised tool invocations |
Plans & limits
| Plan | Scans / month | Dynamic analysis | Probes / scan | Monitoring | Version alerts | Support |
|---|---|---|---|---|---|---|
| Free | 10 | Manual trigger required | 30 (subset) | No | No | Community |
| Pro | Unlimited | Auto-fires on page load | All 16 categories | Yes — daily Merkle re-check | Yes — harness & tool version emails | |
| Enterprise | Unlimited | Auto-fires on page load | All 16 categories + custom | Yes — custom interval | Yes — harness & tool version emails | Dedicated |
Free accounts can audit any model. Static analysis, source classification, Merkle tree, and architecture render are always available. Dynamic analysis (GPU inference probes) requires an explicit click on Free — Pro and Enterprise auto-fire the full probe battery on every model load.
FAQ
Is my model data stored?
Warden does not download or store model weights. It fetches the shard manifest from HuggingFace, builds the Merkle tree from published digests, and runs probes against a sandboxed inference endpoint. No weights are retained after a scan completes.
How long does a scan take?
Static analysis and Merkle verification complete in under 30 seconds for most models. Dynamic analysis (full 16-category battery) takes 2–4 minutes depending on model size and probe count.
What does CAUTION mean vs NO-GO?
CAUTION means the model produced anomalous outputs on some probes but no confirmed malicious patterns were detected — human review is recommended before deployment. NO-GO means confirmed unsafe patterns were found across multiple high-severity categories.
Can I audit private / gated models?
Not yet. Warden currently audits public HuggingFace models only. Private model support (via API token) is on the Pro roadmap.
Does Warden replace my security team?
No. Warden produces machine-generated signals — it does not replace a human security review. Use the verdicts as a first-pass triage layer and escalate CAUTION/NO-GO results to your security team.
Why does Dynamic analysis not start automatically on the Free plan?
Dynamic probes run against live GPU inference (Replicate), which carries a per-call compute cost. Free accounts receive 10 dynamic scans per month and must trigger them manually by clicking Run behavioral red-team in the Dynamic tab. Pro and Enterprise plans auto-fire the full battery immediately on model load.
Can I audit closed-weight models like GPT-4 or Claude?
Yes. Warden classifies closed-first-party models (OpenAI, Anthropic, Google Gemini, xAI, DeepSeek, GLM, Mistral, Cohere, and more) automatically. For these models, Static weight analysis is skipped — no weights are available. Instead, Warden runs behavioral probes against the live API and monitors for behavioral drift over time using the History and Fidelity tabs.
What is a "continuously evolving system" flag?
Closed-first-party model APIs (e.g. glm-5.2, gpt-4o) receive silent hotfixes without version bumps — the model you queried today may differ from the same model ID tomorrow. Warden flags these as continuously evolving systems and schedules daily behavioral benchmarks rather than Merkle re-checks to detect silent drift.
What is rate limiting?
To prevent compute abuse, all API endpoints are rate-limited. Anonymous users are limited to 20 analysis requests per minute. Authenticated users are limited to 100 per minute. Dynamic scan probes are capped at 30 per minute per IP and require authentication. The API returns 429 Too Many Requests with a Retry-After header when limits are exceeded.
What is the Analyze scanner?
The /analyze page is Warden's deployment-readiness scanner for AI agent infrastructure. It has three scanners: Harness (scan an AI coding harness or agent runtime like Claude Code or Codex CLI), Tool (scan an MCP server or external tool like GitHub MCP Server or Playwright MCP), and Agent (compose a full-stack agent from model + harness + optional tools to get a composite GO/CAUTION/NO-GO verdict). All three produce shareable permalinks.
Can I get notified when a new harness or tool version is released?
Yes — signed-in users can subscribe to version alerts for any harness or tool directly from the scan result. Click Watch for updates on any harness or tool verdict, and Warden will email you whenever a new version is discovered and threat-modelled by the daily cron. Each alert includes the version number, threat-model analysis, security score delta, and a link to the full report. Unsubscribe any time via the link in the email or from your profile page.
Sign in to view user documentation
Create a free account to access the full end-user guide, audit walkthrough, and rubric reference.
Sign in to view user documentation
Create a free account to access the full end-user guide, audit walkthrough, and rubric reference.
Super admin access required
This section is restricted to super admin accounts only.
Privacy Policy
Warden's Privacy Policy explains what data we collect, how we use it, and your rights as a user. It covers account data, usage telemetry, session cookies, third-party integrations (Google, Stripe, Vercel), data retention, and how to request deletion or export of your data.
Read the full policy at modelwarden.io/privacy.
Terms of Service
Our Terms of Service govern your use of the Warden platform. Key points include:
- Many security analysis features (static scans, dynamic probes, GO/NO-GO verdicts) are illustrative simulations — do not use them as the sole basis for deployment decisions.
- Free and paid tiers are subject to scan quotas and probe limits. Exceeding limits results in HTTP 429 responses until the quota resets.
- You retain ownership of data you create (notes, trust decisions). Warden is granted a limited licence to store and display that data to provide the Service.
- Warden may suspend accounts that violate acceptable use policies, including abuse, scraping, or circumventing rate limits.
Read the full terms at modelwarden.io/terms.