Model and dataset distribution
Tessera
Trust the signature. Never the transport.
A content-addressed distribution layer for models and datasets, where an artifact is identified by a Merkle root over its chunks rather than by a URL somebody controls. Publishers sign roots, and a mirror can serve chunks without being trusted, because the client verifies each chunk against the root before it reaches disk. Poisoning is contained rather than prevented: a tampered chunk fails at the point of use, and the log of signed roots makes the substitution attributable.
Why addressing matters
Weights are usually fetched from a name. A name resolves to a host, a host serves bytes, and the only thing standing between a researcher and a substituted checkpoint is that host behaving. Content addressing inverts it: the identifier is derived from the bytes, so a mirror cannot serve anything other than the artifact you asked for without the client noticing.
Chunk-level verification
Artifacts are split into fixed-size chunks and hashed into a Merkle tree. A client fetching a chunk also fetches its inclusion proof and checks it against the signed root before the chunk is written anywhere durable. Verification is streaming, so a hundred gigabyte checkpoint does not have to land before it can be checked.
This is also what makes partial and resumable fetches safe. A resumed download cannot be poisoned at the seam, because the seam is a chunk boundary and the chunk is verified independently.
Containment, not prevention
Nothing here stops a publisher from signing a poisoned artifact. What it does is make the poisoning a matter of record: the root is signed, the signature is logged, and the log is append only. If a dataset turns out to be tainted, you can determine exactly which root introduced it and exactly which downstream artifacts consumed it.
Attribution is a weaker property than prevention and a far more achievable one.