How Do You Lock Down an AI Model's Most Valuable Files? A New Framework Tries.

Ask any AI provider you interact with what tier their model weights sit at, and against which threat model. Right now, almost no one can answer. The trained model is a file, often a very large, very valuable one, and there is no shared vocabulary for how carefully it is guarded. A new RAND framework, Security Level 3 (SL3), is the first published attempt to give that question a shared vocabulary.

SL3 is built from 262 security controls adapted from NIST Special Publication 800-53, the U.S. government's catalog of cybersecurity controls, and applied specifically to the model itself rather than to the data it learned from. Published on August 25, 2026 as RAND report RR-A4704-1, the framework maps those controls to 31 attack vectors that researchers consider feasible inside a six to 12 month implementation window, ranging from insider exfiltration by employees with privileged access to organized cybercrime rings hunting for weight files. The report is published alongside an open control catalog on GitHub that any security team can fork, inspect, or adapt to its own model inventory.

A model leak is not a data breach. The leaked model can be copied wholesale, fine-tuned on a different corpus, repackaged under a new brand, or weaponized for downstream attacks. A dataset theft leaks what a model was trained on; a weight theft hands the attacker the model itself. Most enterprise security programs still treat AI assets as data, which leaves the model as the most valuable file in the building protected by the same controls as a sales spreadsheet.

RAND anchored the framework to scaffolding security teams already recognize. SL3 borrows the control structure from NIST SP 800-53 and the NIST COSAiS overlay project, which extends federal cybersecurity controls to AI systems, and lines up against NISTIR 8596, the Cyber AI Profile. For a security team already running an 800-53 program, SL3 functions as a translation table for a new asset class, extending existing controls to model files. The 39-page report, authored by Jair Aguirre, Phillip Robertson, Steven F. Comer, Matthew J. Malone, and Wesley Hurd and peer-reviewed under RAND's standard process, treats that translation as the central deliverable.

The limits are real. SL3 is voluntary, and adopting it costs organizational weight rather than engineering weight. Someone has to maintain a live inventory of which models the organization holds, where the weights sit, who has administrative access, and how training pipelines move data and parameters across trust boundaries. That work has to keep pace as architectures change, models get fine-tuned, and new versions ship. The hardest part is not the controls; it is keeping the inventory current. A recent arXiv preprint on open-weight LLM cyber risk reaches a parallel conclusion from a different starting point, noting that once weights are public the attacker has the same model the defender built, which raises the bar for any post-leak response and makes pre-leak controls the only durable defense.

The portable payoff is the question itself. A vendor that claims to take AI security seriously should be able to say which tier the model sits at, against which threat model, and which of the 262 controls are in place. If they cannot, that is the answer.

The first lab to publish SL3-aligned documentation, or a comparable tiered framework, will be the signal that weight security has moved from press-release language to operational discipline. Without that, the framework stays a vocabulary vendors can cite without changing how they protect the model file.