Distillation Lineage Governance: Proving What Your Model Was Made From

1. The Distillation Problem

NSTM-4, the White House national security memorandum issued April 23, 2026, treats adversarial distillation of American AI models as a national security concern. The memorandum does not define a compliance framework. It establishes a policy position: the unauthorized extraction of capabilities from frontier AI systems threatens US strategic advantage, and organizations in the AI supply chain bear responsibility for documenting model provenance.

The Kimi K3 controversy reignited the debate over unauthorized capability extraction from frontier models. Researchers demonstrated that distillation techniques could reproduce substantial portions of a teacher model's capabilities without direct access to its training data or architecture. CNBC reported in July 2026 that distillation had become "the most dominant AI policy obsession in Washington."

The European Union arrived at a parallel conclusion through a different path. EU AI Act Article 53 requires GPAI providers to produce technical documentation that includes model derivation and training methodology. The provision became enforceable on August 2, 2026.

CISA Advisory AA26-251A, published in September 2026, documented industrial-scale model extraction campaigns targeting commercial AI providers. The advisory confirmed that adversarial distillation is not theoretical -- it is an active threat with documented campaigns.

The core problem is structural: an organization can deploy a model today without any verifiable record of whether its weights originated from authorized or adversarial distillation. Model documentation standards were designed for a world where models were trained, not derived. The distillation supply chain has outpaced the governance tooling.

2. Why Model Cards Are Not Enough

Model cards (Mitchell et al. 2019) describe what a model is: architecture, intended use, training data, performance benchmarks. They were designed for single-generation models -- a model trained from scratch on a known dataset, evaluated against known benchmarks, and deployed for a stated purpose.

A model card for a distilled model might say "distilled from Model X." But it cannot answer the questions that regulators, procurement officers, and national security reviewers are now asking:

• Was the distillation authorized by Model X's provider?
• How many intermediate generations exist between the original and this derivative?
• Were any adversarial extraction techniques used anywhere in the chain?
• Has the distillation chain been independently verified?

September 2026 research ("Current Model Cards Are Insufficient for Downstream Governance of Open-Weight Foundation Models") confirms this structural limitation. Model cards were never intended to trace multi-generation derivation. They document a snapshot. Distillation lineage requires a chain.

3. What Lineage Attestation Changes

The distinction is not academic. A defense contractor evaluating an AI model for logistics optimization needs to certify that its supply chain is clean. A European GPAI provider needs to demonstrate Art. 53 compliance to the AI Office. A bank deploying a fine-tuned model needs to verify that its vendor did not train on adversarially extracted outputs. Distillation lineage attestation makes all three of these certifications auditable.

4. Regulatory Landscape

5. Procedure Detail Cards

6. Clearing Levels and Distillation Risk

7. Scenario: The Inherited Weights

A defense contractor procures an AI model for logistics optimization from a commercial vendor. The vendor's documentation says "fine-tuned from Llama 3.1 70B." But Llama 3.1 was itself partially trained using techniques that Meta has described as drawing on broad web data, which increasingly includes outputs from other AI systems. The vendor also incorporated synthetic training data generated by GPT-4o to augment their logistics-specific dataset.

The contractor's procurement officer asks: "Can you certify that the weights in this model were not derived from adversarially extracted sources?"

Without distillation lineage attestation, the answer is: "We believe so, but we have no independent evidence." The vendor's model card describes the model's capabilities and benchmarks. It does not trace the derivation chain. It does not attest to authorization at each generation. It does not flag whether any link in the chain involved adversarial extraction.

With SWT3 lineage attestation, each link in the chain produces a verifiable anchor:

• The vendor's AI-DIST.2 anchor records authorization status (authorized), lineage depth (1 -- direct fine-tune from Llama 3.1), and adversarial flag (clear).
• The AI-SUPPLY.1 anchor records Meta as the upstream provider.
• The AI-MDL.5 anchor records the weight hash at the moment of fine-tuning.
• The AI-CHAIN.1 anchor links these attestations into a single verifiable chain.

The contractor's procurement officer can now verify each attestation independently -- and under NSTM-4, that independent verifiability may become a contract requirement.

8. Coverage Matrix

9. Quick Start

Python

from swt3_ai import Witness

w = Witness(
    api_key="axm_your_key_here",
    endpoint="https://sovereign.tenova.io/api/v1/witness"
)

# 1. Record distillation provenance
w.witness("AI-DIST.1", verdict="PASS",
    factor_a=0,   # response-based distillation
    factor_b=42,  # 4.2x compression ratio (x10)
    factor_c=1    # ToS verified
)

# 2. Record lineage attestation
w.witness("AI-DIST.2", verdict="PASS",
    factor_a=1,   # authorized
    factor_b=1,   # first-generation distillation
    factor_c=0    # no adversarial indicators
)

# 3. Record weight integrity at distillation time
w.witness("AI-MDL.5", verdict="PASS",
    factor_a=1,   # hash verified
    factor_b=1,   # file match
    factor_c=0    # no tampering detected
)

w.flush()

TypeScript

import { Witness } from '@tenova/swt3-ai';

const w = new Witness({
  apiKey: 'axm_your_key_here',
  endpoint: 'https://sovereign.tenova.io/api/v1/witness',
});

// 1. Record distillation provenance
await w.witness('AI-DIST.1', {
  verdict: 'PASS',
  factorA: 0,   // response-based distillation
  factorB: 42,  // 4.2x compression ratio (x10)
  factorC: 1,   // ToS verified
});

// 2. Record lineage attestation
await w.witness('AI-DIST.2', {
  verdict: 'PASS',
  factorA: 1,   // authorized
  factorB: 1,   // first-generation distillation
  factorC: 0,   // no adversarial indicators
});

await w.flush();

Ready to start documenting distillation lineage? Create a free account to get an API key, or explore the full SDK documentation for advanced usage including chain witnessing, batch attestation, and clearing level configuration.

10. References and Related Guides

• CISA Distillation Advisory Crosswalk -- security-focused evidence for AA26-251A
• Dual-Use AI Export Control Crosswalk
• Open-Weight Model Governance Gap
• NSPM-11: AI in the National Security Enterprise
• SLM Compliance Evidence Guide
• SDK Documentation
• UCT Procedure Registry