Product
A monitor that audits its own trust, not just yours.
AuxAI sits between any AI model and its consumers, whether that's a flight controller, a dashboard, or an API caller, reading only its outputs, never its weights or gradients, and runs a tiered self-healing pipeline that never assumes it is the one part of the system that can't fail.
The guarantee, stated plainly
We never require your model's weights, gradients, or training data, for detection, for diagnosis, or by default, for healing either.
Three fields at inference time, an embedding, a confidence signal, and a decision, are all this system has ever needed from the model it watches. Write access to that model is a deployment choice you can grant later for a deeper healing mode, never a precondition for using this product.
Architecture
Four tiers, each catching what the one before it structurally can't.
Hardware integrity
A real cryptographic hash of the monitor's own weights, checked against a fingerprint issued from outside the device, never from its own past state. A mismatch quarantines the node and requests a verified resync. No local repair is attempted on a system that can no longer vouch for itself.
Behavioral self-test
Weight checks catch storage corruption but miss compute-path faults and logic bugs. Four independent checks, canary inputs, output-distribution sanity, jitter stability, and fleet-consistency, catch the failures a hash alone cannot.
Model drift
A sequential change-detection test on out-of-distribution signal, so a single noisy input never triggers a false alarm, only genuine, sustained drift does. This is what catches a model that was incompletely trained: coverage gaps in the original training data surface at deployment as sustained novelty, not a single bad frame, exactly the pattern this test is built to detect rather than dismiss as noise. A second check then tells "the environment changed, same categories" apart from "this is a genuinely new category the model never saw," since only the former is safe to learn from automatically, a true unknown routes to a human, never a silent auto-fine-tune.
Model audit
This is the only tier that ever touches the model being watched, and it is opt-in, never assumed. By default the audited model stays fully opaque: no weights, no gradients, no training data, ever. Where a deployment explicitly grants write access to its own checkpoint, the same weight-hash and repeatability canary extend to it too, closing the gap between "the output looks anomalous" and "the model itself is compromised." Nothing above this tier, detection, diagnosis, or the default healing path, requires that access to work.
Two different faults, two different tells
A hardware fault and a behavioral fault look identical from the outside. They aren't.
Something is wrong with what's stored
A bit-flip, memory corruption, a value silently pushed out of range: the weights on disk are no longer the weights that were verified. A cryptographic hash catches this by definition, comparing what's stored now against a trusted fingerprint, byte for byte.
Something is wrong with what's computed
The weights are completely intact and hash-verified, yet the same input stops producing the same output: a compute-path glitch, a transient processor error, a logic bug. A hash is structurally blind to this, there's nothing wrong with what's stored, so the behavioral suite instead re-runs known reference inputs and checks the output distribution itself for a stuck, NaN, or chaotically unstable signal, catching exactly what the hash can't.
Both diagnoses currently route to the same remedy, a verified resync, since a fresh, externally-issued model is the available fix either way. If Meta keeps failing after repeated resyncs, the system stops assuming a reload will help and escalates to a human instead, see "Escalate, don't loop" below.
Fault localization
Detection and diagnosis stay separate from repair, on purpose.
Every signal above feeds a single routing table that decides where a problem actually originates before anything is touched: a compromised monitor is never trusted to grade the model it's watching, and a corrupted model is never mistaken for a legitimate discovery worth learning from.
Verified resync
A hardware or behavioral fault in the monitor is never repaired locally. The only remedy is a fresh, server-verified model, a node can't certify its own health against itself.
Heal ourselves, always
The monitor's own model retrains on real, buffered data, validated against a held-out split before it's ever trusted, and every accepted version joins a bounded rollback ladder. This never touches, and never needs to touch, the model being watched.
Heal the watched model, only if invited
By default, confirmed drift in the watched model is met with caution, not surgery: an extended hold, a wider safety margin, an alert, none of it requires touching that model's weights. A deployment can explicitly grant write access to its own checkpoint, and only then does the same fine-tune, validate, and rollback loop extend to it too, a privilege of that specific integration, never a requirement of the SDK.
Escalate, don't loop
A fault that keeps recurring after repeated automated fixes stops retrying and raises a human alert instead. Self-healing that never gives up is a liability, not a feature.
Fleet learning
What one unit learns strengthens the fleet, without a single raw data point leaving it.
A federated aggregation loop is also where a quarantined node's trust anchor actually comes from, never generated on-device. Updates are validated for sanity before they're accepted, and weighted by how reliable each contributing unit currently is, so a degraded node can't drag the whole fleet's model down while it's mid-recovery.
The result: your fleet gets better from real operating conditions, not just from what was in the training set the day it shipped, and every step of that improvement is validated before it's trusted.
Integrate the SDK
Three inputs. One decision object. No access to your model required.
The SDK doesn't care what kind of model you run, a vision transformer, a classical control loop, a forecasting model, or a policy network, only that it can produce these three things at inference time. If your model already logs a confidence score for debugging, you're most of the way there.
Quickstart, Python
# Any framework, any model family, the SDK only needs three things
# per inference: an embedding, a confidence signal, and a decision.
from AuxAI import TrustLayer
trust = TrustLayer.from_config("AuxAI.config.yaml")
# In your existing inference loop, wherever it lives:
output = my_model.predict(input_batch)
result = trust.evaluate(
model_output={
"embedding": output.embedding, # feature vector / penultimate layer
"confidence": output.confidence, # softmax, logit, or calibrated score
"prediction": output.prediction, # class, box, control signal, forecast...
},
sensor_reading=telemetry.snapshot(), # optional: IMU, GPS, timestamps, anything
)
if not result.trusted:
actuator.hold() # veto the action before it happens
log.warn(result.decision) # e.g. "tier1_sustained_drift"
Any other stack, over a local service call
# Not on Python, or the model runs in a different process/service?
# Wrap the same three inputs behind a small local endpoint, the SDK
# talks to itself over gRPC/REST identically either way.
POST /v1/evaluate
{
"embedding": [0.0123, -0.881, ...],
"confidence": 0.94,
"prediction": {"class": "pedestrian", "box": [120,80,300,400]},
"sensors": {"imu_ok": true, "gps_hdop": 1.2}
}
-> {
"trusted": false,
"reliability_score": 0.11,
"diagnosis": "tier0_hash_mismatch",
"action": "quarantine_and_resync"
}
Framework-agnostic
PyTorch, TensorFlow, ONNX, a hand-rolled classical controller, it doesn't matter. Only the three output fields matter.
Language-agnostic
Native SDK in Python today; a thin REST/gRPC wrapper makes it reachable from C++, Rust, Go, or anything else.
Deploy-target-agnostic
Runs in-process on the same edge device as your model, as a sidecar container, or as a nearby local service.