A new protocol, DISCERN, is proposed to certify model updates without requiring labeled data. DISCERN uses unlabeled traffic to detect benign updates and an audited tier to label sampled disagreements. The protocol is proven to have finite-sample validity and matching label-complexity bounds, and is demonstrated on 14,000+ replayed audit streams across 785 update pairs.