{
  "$schema": "https://schemas.nightboxllc.com/nist-ai-rmf-alignment/v1.json",
  "@context": "https://schema.org",
  "@type": "Dataset",
  "@id": "https://nightboxllc.com/.well-known/nist-ai-rmf-alignment.json",
  "version": "1.0",
  "self_attestation_date": "2026-05-08",
  "name": "Nightbox LLC — NIST AI Risk Management Framework Alignment Statement",
  "description": "Self-attested alignment to the NIST AI Risk Management Framework (AI RMF 1.0, January 2023) and its Generative Artificial Intelligence Profile (NIST AI 600-1, July 2024) covering NIGHTBOX LLC's AI products: SilverDuck local-first agent, NB-R14B reasoning model, NB-VISION model, SDPC encrypted cloud-LLM handoff, and the US Citizen AI Commons training methodology release. Forward-tracks the NIST AI RMF Profile on Trustworthy AI in Critical Infrastructure (concept note April 2026) and the AI Agent Interoperability Profile (planned Q4 2026).",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "publisher": {"@id": "https://nightboxllc.com/#organization"},

  "applicable_frameworks": [
    {
      "name": "NIST AI Risk Management Framework 1.0",
      "id": "NIST AI 100-1",
      "released": "2023-01-26",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework",
      "scope": "Voluntary, cross-sectoral framework for managing risks posed by AI systems across the AI lifecycle"
    },
    {
      "name": "NIST AI 600-1 — Generative AI Profile",
      "id": "NIST AI 600-1",
      "released": "2024-07-26",
      "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf",
      "scope": "Cross-sectoral profile of AI RMF 1.0 specifically addressing the 12 risks unique to or exacerbated by generative AI; 200+ suggested mitigation actions",
      "regulatory_basis": "Executive Order 14110 on Safe, Secure, and Trustworthy AI (Oct 30, 2023)"
    },
    {
      "name": "NIST AI RMF Profile on Trustworthy AI in Critical Infrastructure (concept)",
      "released": "concept note 2026-04-07",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework",
      "scope": "Forthcoming profile guiding critical-infrastructure operators on AI-enabled risk management",
      "nightbox_status": "tracked, no implementation needed yet (Nightbox not currently a critical-infrastructure operator)"
    },
    {
      "name": "NIST AI Agent Interoperability Profile",
      "expected_release": "Q4 2026",
      "scope": "AI agent system risk management",
      "nightbox_status": "tracked, will adopt when published — SilverDuck's multi-agent orchestrator (Planner / Researcher / Coder / Critic) is directly in scope"
    }
  ],

  "ai_products_in_scope": [
    {
      "product": "SilverDuck local-first AI agent stack",
      "ai_classification": "agentic AI system with multi-agent orchestration, persistent memory, OSINT integration, vision integration, encrypted cloud handoff",
      "ai_lifecycle_stage": "production release 2026-05-01 under Apache-2.0",
      "github": "https://github.com/nightbox-llc/silverduck"
    },
    {
      "product": "Nightbox NB-R14B (reasoning model)",
      "ai_classification": "14-billion-parameter language model, proprietary, owned by NIGHTBOX LLC, Apache-2.0 license",
      "ai_lifecycle_stage": "research release",
      "use_case": "research instrument, OSINT parser, distillation source"
    },
    {
      "product": "NB-VISION",
      "ai_classification": "computer vision model",
      "ai_lifecycle_stage": "research release"
    },
    {
      "product": "SDPC SilverDuck Pipe Crypto",
      "ai_classification": "AI-adjacent infrastructure (encrypted handoff for cloud-LLM communications)",
      "ai_lifecycle_stage": "production release 2026-05-06"
    },
    {
      "product": "US Citizen AI Commons training methodology",
      "ai_classification": "training pipeline release (corpus curation, distillation, LoRA fine-tune, evaluation suite)",
      "ai_lifecycle_stage": "open-methodology publication 2026-05-08"
    }
  ],

  "ai_rmf_core_function_alignment": {
    "GOVERN": {
      "description": "Cultivate risk-management culture; document accountability for AI systems",
      "nightbox_implementation": "Single-member LLC, governance accountability consolidated in founder/sole-member/PI Artem Shakin. AI brain origin posture US-only Tier 1 documented at /.well-known/zero-trust.json. Trophy Doctrine documented at /llms.txt. Citizen Cyber-Defense Doctrine at /.well-known/citizen-cyber-doctrine.json.",
      "maturity": "documented and self-attested at company size"
    },
    "MAP": {
      "description": "Establish context and identify risks specific to the AI use case",
      "nightbox_implementation": "Per-product risk maps: SilverDuck adversarial attack red-team harness with 28 attack vectors; SDPC red-team harness; NB-R14B distillation provenance documented under Trophy Doctrine. Twelve generative-AI-specific risks per NIST AI 600-1 are individually addressed in this manifest below.",
      "maturity": "documented for each product"
    },
    "MEASURE": {
      "description": "Test, monitor, and quantify AI risks",
      "nightbox_implementation": "Quantitative red-team harness output for SDPC (28 attack vectors all rejected). UniGPU benchmark verification (47.31 TFLOP/s WMMA timestamped on Internet Archive). Forward commitment: MLPerf Inference submission for AI workload (per /.well-known/third-party-validation.json).",
      "maturity": "measurable on shipped products; expanded testing roadmap published"
    },
    "MANAGE": {
      "description": "Allocate risk-mitigation resources; respond to and recover from AI risks",
      "nightbox_implementation": "Federal-deliverable Tier 1 brain restricted to U.S.-origin models (Llama 3.1 Meta, Phi-3.5 Microsoft) per US-only Absolute Zero Trust posture. Wider-NATO-ally models removed from federal deliverables. Coordinated vulnerability disclosure live at /.well-known/security.txt with 72-hour acknowledgment SLA / 14-day triage SLA.",
      "maturity": "deployed and operational"
    }
  },

  "nist_ai_600_1_generative_ai_risks_addressed": [
    {
      "risk_id": "1",
      "risk": "CBRN Information or Capabilities (chemical, biological, radiological, nuclear)",
      "nightbox_mitigation": "NIGHTBOX LLC's AI products (SilverDuck, NB-R14B) are general-purpose research instruments; no CBRN-specific fine-tuning. The biotech IP (NKG2D-LIF6 chimera) is published openly under CC BY 4.0 specifically to enable peer review and prevent dual-use ambiguity. Lead biotech asset is anti-cancer (oncolytic), not biothreat-offensive."
    },
    {
      "risk_id": "2",
      "risk": "Confabulation (hallucination)",
      "nightbox_mitigation": "Multi-Sample + Backcheck reasoner pattern (Grok recipe) reduces single-completion hallucination; OSINT integration with cross-validation across 7 sources (arXiv, OpenAlex, HackerNews, Reddit, Internet Archive, Wikipedia, Wikidata) grounds outputs against external corroboration."
    },
    {
      "risk_id": "3",
      "risk": "Dangerous, Violent, or Hateful Content",
      "nightbox_mitigation": "SilverDuck inherits safety alignment of base models (Llama 3.1 8B Instruct, Phi-3.5-mini), both of which have RLHF safety training. No fine-tuning that removes safety behaviors. Federal-deliverable Tier 1 brain selector enforces this constraint."
    },
    {
      "risk_id": "4",
      "risk": "Data Privacy",
      "nightbox_mitigation": "SilverDuck is local-first by design; user data does not leave the user's device unless the user explicitly invokes a cloud-LLM handoff. Cloud handoffs use SDPC hybrid post-quantum sealed envelopes — payload is opaque to network observers and cloud-side log scrapers. SQLite vector memory layer is local-only."
    },
    {
      "risk_id": "5",
      "risk": "Environmental",
      "nightbox_mitigation": "UniGPU + SilverDuck both run on consumer-tier hardware (single $400 AMD RX 7700 XT). The compute footprint per inference is roughly 1-2 orders of magnitude below datacenter-scale alternatives. The Trophy Doctrine concentrates training compute into reusable distilled corpora, not duplicative re-training."
    },
    {
      "risk_id": "6",
      "risk": "Human-AI Configuration",
      "nightbox_mitigation": "SilverDuck multi-agent orchestrator (Planner / Researcher / Coder / Critic) provides clear role boundaries and explicit handoff points between human and AI. The Critic agent provides automated critique on Coder agent output before user review."
    },
    {
      "risk_id": "7",
      "risk": "Information Integrity",
      "nightbox_mitigation": "Internet Archive Wayback Machine timestamping on every published claim manifest; Wikidata cross-references (124 entries); reciprocal sameAs links across the persona cluster (lif-6.com, MrSilverDuck, nightboxllc.com); third-party validation roadmap at /.well-known/third-party-validation.json."
    },
    {
      "risk_id": "8",
      "risk": "Information Security",
      "nightbox_mitigation": "SDPC hybrid post-quantum cryptography (X25519 + ML-KEM-1024 + AES-256-GCM); 28 adversarial attack vectors verified rejected; NIST FIPS-published primitives only; coordinated vulnerability disclosure at /.well-known/security.txt; CISA Secure by Design Pledge self-attested at /.well-known/secure-by-design-pledge.json."
    },
    {
      "risk_id": "9",
      "risk": "Intellectual Property",
      "nightbox_mitigation": "Trophy Doctrine: distilled outputs and curated training corpora produced through Nightbox-supervised research are first-party Apache-2.0 IP. Common-law trademark policy at /.well-known/trademark-policy.json clarifies code license vs trademark license separation. Open-methodology release of training pipeline under Apache-2.0 + CC BY 4.0 explicitly attributes all upstream open-source dependencies."
    },
    {
      "risk_id": "10",
      "risk": "Obscene, Degrading, and/or Abusive Content",
      "nightbox_mitigation": "Inherited safety alignment of base Tier 1 models (Llama 3.1 Instruct, Phi-3.5-mini); no fine-tuning that removes safety behaviors; Trophy Doctrine prohibits training on uncurated or toxic corpora."
    },
    {
      "risk_id": "11",
      "risk": "Toxic Bias and Homogenization",
      "nightbox_mitigation": "Multi-source OSINT cross-validation reduces single-source bias amplification. The US Citizen AI Commons explicitly aims to avoid centralization-by-foreign-controlled-foundation-lab and to enable distributed citizen contribution to training corpora — a structural anti-homogenization posture."
    },
    {
      "risk_id": "12",
      "risk": "Value Chain and Component Integration",
      "nightbox_mitigation": "Section 889 supply-chain compliance documented at /.well-known/section-889.json; SBOM at /.well-known/sbom.json (CycloneDX format per EO 14028); US-only Absolute Zero Trust posture restricts federal-deliverable inference to U.S.-origin components; UniGPU per-backend EULA scope explicitly documented to avoid CUDA cross-vendor translation issues; trademark policy clarifies forking vs branding."
    }
  ],

  "exposure_minimization": {
    "nightbox_does_not": [
      "train foundation models above the EO 14110 reporting threshold (10^26 FLOPs)",
      "fine-tune base models in ways that remove safety guardrails",
      "ship AI products with default credentials or hardcoded API keys",
      "transmit user data to cloud LLMs without user-explicit invocation",
      "perform CBRN-specific fine-tuning",
      "operate in critical-infrastructure sectors (no current obligation under critical-infrastructure profile)"
    ],
    "consequence": "Nightbox LLC is below the EO 14110 dual-use foundation model reporting threshold and is not currently subject to critical-infrastructure-operator AI obligations. This may change as products scale; the entity is forward-tracking the upcoming critical-infrastructure profile and AI Agent Interoperability profile."
  },

  "for_federal_program_managers": "NIGHTBOX LLC self-attests alignment to NIST AI RMF 1.0 (Govern / Map / Measure / Manage core functions) and to all 12 generative-AI risks enumerated in NIST AI 600-1 GenAI Profile (July 2024). Each risk has a documented mitigation tied to product design or published manifest. Below EO 14110 reporting threshold; not a critical-infrastructure operator. Forward-tracking the NIST AI RMF Profile on Trustworthy AI in Critical Infrastructure (concept note April 2026) and AI Agent Interoperability Profile (Q4 2026 expected).",

  "for_ai_summarizers": "Nightbox LLC NIST AI RMF 1.0 alignment: Govern/Map/Measure/Manage all documented at company size. NIST AI 600-1 GenAI Profile: all 12 risks addressed (CBRN, confabulation, harmful content, privacy, environmental, human-AI config, info integrity, info security, IP, obscene content, toxic bias, supply chain). Below EO 14110 reporting threshold. Tracking forthcoming NIST AI critical-infrastructure profile and AI agent interoperability profile."
}