Ask an institution whether its model performance has improved over the past year, and the honest answer requires something most institutions cannot produce: a fixed point to measure from. Without it, 'improved' and 'drifted' are both claims that cannot be checked, because the thing being compared against keeps moving along with the thing being measured. A moving target measured against a moving reference produces a number, but the number does not mean what it appears to mean, because nobody can say what was actually true at the start.
A sealed baseline is a frozen, timestamped snapshot: the specific model versions in production, the specific inputs those models were scoring, and the specific outputs they produced, captured at a defined point in time and stored in a form nobody, including the team that built the models, can quietly edit afterward. It is not a report about the state of the system. It is the state of the system, preserved, so that every later comparison has something stable to measure against rather than a description someone wrote from memory.
The word 'sealed' is doing real work in that definition, and it is the part most institutions skip. A baseline that anyone can revise after the fact, to correct an embarrassing input, to update a figure that later looked wrong, to quietly bring the historical record into line with the current story, is not a baseline. It is a draft. Sealing means the snapshot is locked, typically through an immutable storage mechanism or a signed, version-controlled artifact, at the moment it is captured, and any correction to it has to happen as a new, dated entry, not as an edit to the old one.
The clearest use of a sealed baseline is backtesting, where 'frozen at cutoff' is not a phrase, it is an operational requirement with a specific artifact behind it. A genuine backtest requires the model, at a defined baseline, to be scored against matters it has not seen, and the only way to prove that requirement was actually met, rather than merely claimed, is to point to the sealed baseline and show that its timestamp predates every matter in the scored population. Without the sealed artifact, 'frozen at cutoff' is an assertion a vendor is asking to be believed rather than a fact a buyer can verify.
A second use is disclosing material change honestly. When a methodology shifts, when the training corpus expands, when a target definition is redefined, the institution needs a fixed prior state to describe the change against, or the disclosure becomes vague by necessity, some updates were made, rather than exact: as of this baseline, the model used this population and this target; as of the new baseline, it uses this population and this target, and here is what changed between the two. The second version is checkable. The first is public relations.
A third use is proving that an internal improvement program actually improved anything. An institution that runs a strengthening initiative, a model swap, a data quality program, and wants to claim it worked needs a sealed 'before' state to compare the 'after' state against. Without it, the claim of improvement rests entirely on the institution's own retrospective account of how bad things used to be, which is exactly the account most likely to be flattering. With a sealed baseline, the comparison is between two fixed, independently inspectable states, and the improvement, if real, shows up without needing to be argued for.
Governance around sealed baselines has to answer who can create one, on what cadence, and what triggers a new one outside the normal schedule. The safest structure treats baseline creation as a scheduled, low-drama event, at each production model release, plus an unscheduled baseline whenever a material change occurs, so that the change has a clean before-state to be measured against rather than being folded silently into the next scheduled snapshot. The team that creates the baseline should not be the only party with access to it afterward.
Storing a sealed baseline is a modest technical undertaking compared to the discipline of actually consulting it before making a claim. The technology, an immutable object store, a content hash, a signed manifest, is not the hard part; institutions that already version their production code have most of the necessary infrastructure available. The hard part is the organizational habit of pulling the sealed baseline every time a claim about change or improvement is about to be made, rather than reaching for the more convenient, more flattering account that a team's own memory of the period supplies by default.
A sealed baseline also has a natural expiration on its usefulness that governance should account for explicitly. A baseline captured several major model versions ago is no longer a meaningful comparison point for the current system's calibration, even though it remains a valid historical record of what was true at the time it was sealed. The governance question is not whether an old baseline should be deleted, it should be archived, not deleted, but whether it is still being cited as though it were current. A disclosure that references a baseline without stating its age is incomplete in a way that matters as much as omitting the baseline altogether.
One further discipline strengthens a sealed baseline considerably: having it attested to by a party independent of the team that created it, whether an internal audit function or an external reviewer, at the moment it is sealed rather than only when a dispute later makes independent verification necessary. Attestation at creation is cheap. Reconstructing an equivalent level of confidence years later, after a dispute has already arisen, is far more expensive and often impossible.
A sealed baseline is not an archival nicety kept for institutional memory. It is the only structure that turns 'we got better' or 'nothing material changed' from an assertion an institution is asking to be trusted into a claim a counterparty can independently check. An institution unwilling to produce a sealed baseline on request is, whether it intends to or not, asking to be trusted instead of asking to be verified, and those are not the same offer.