Computational Provenance: How to Trust What an AI System Claims

A hash proves bytes match. A signature proves who endorsed them. A causal intervention proves a specific internal state shaped an answer. None of the three proves the answer is true. Executives funding one all-purpose verified-origin badge for AI output are funding a claim wider than the evidence under it, and the 2026 research assembled here shows exactly where that gap opens.

What it is

Provenance and attestation cover at least seven distinct claims, and none subsumes another: data provenance (where information came from), artifact lineage (what was done to it), execution attestation (a measured environment or event), model identity, watermarking (a statistical attribution signal), internal causal tracing (whether a computation depended on a given state), and output attribution (an issuer or process under its own stated assumptions). Treating a narrow one as if it covers a broader one is the most common and most expensive mistake in how enterprises talk about trustworthy AI today.

A claim is only as strong as the specific proposition it certifies: an authorized issuer can sign a false number, such as a stated balance of 100 when the authoritative balance is 80, without the signature ever breaking. Showing evidence was available to a system is not showing the system relied on it, since a shared upstream cause can make two things move together with no dependence between them. Every mechanism here also rests on a trust boundary, some component assumed honest, the logger, the issuer, the instrumentation, and that boundary has to be named out loud.

Three 2026 studies mark the edge of what is proven. A causal-state construction tested 128 public and 128 protected pairs per architecture across multiple seeds inside purpose-built small arithmetic networks, forcing computation through discrete states whose authenticated observations controlled the output. It depends on trusted instrumentation, and answer-only probing of ordinary transformers at the same sites found no equivalent state, so the result stays confined to constrained architectures, not open natural-language generation. A second, on application-layer attestation for multi-hop API pipelines, is graded lower because it stops at trusted-issuer commitments and prototype-scale timings, not wide-area measurements. A third tested six watermark schemes against five attacker models, using 100 training pairs and 400 evaluation examples standardized to 500 tokens, and found spoofing resilience varies by scheme and attacker. None of the three shows a signed, watermarked or attested output is true.

The architecture

The clearest way I have found to run this is what I call the claim-scope chain: a claim about an AI output earns each additional word of trust only through its own new, specific evidence, never by borrowing the evidence already spent one link back.

The chain starts with byte identity, a hash supporting only that the captured bytes are the bytes in question. The next link is issuer, a signature supporting only that a specific key holder endorsed those bytes under the verification protocol. The next is lineage, a signed record of the transformations and environment an artifact passed through, supporting only that the recorded hops happened as logged, not that every hop that mattered was logged. From lineage the chain forks. One path is causal reliance: a controlled intervention, such as randomizing a private fact after the evidence path is fixed and checking whether the output moves, supporting that a specific state actually shaped the answer. The other path is semantic truth, the proposition that the content itself is correct, which nothing upstream can supply. Treating it as reached the moment lineage is established is the overclaim this discipline exists to catch.

A stage's output guarantee has to actually satisfy the next stage's input assumption, not merely exist alongside it. And a chain with a gap should report that gap as one of four honest states, a complete chain, a verified prefix, an explicit truncation or an absent attestation, rather than rounding a partial chain up.

What it is worth

Ownership belongs with a function structurally separate from whoever builds the system being attested, because the chain's core requirement, evidence a claimant cannot quietly upgrade, fails the moment one team controls both the claim and its label. That function owns the claim taxonomy, the signing keys kept outside any model's editable workspace, and the language used to describe what was actually checked. Fund three things first: signed request and output bindings with freshness and nonce policies, transformation lineage and execution receipts captured at each hop, and a standing program of causal-reliance tests rather than treating an evidence log as proof of reliance. Measure the share of claims landing at each of the four honest states and the share of causal-reliance claims actually intervention-tested.

Two decisions belong to the executive alone: naming the trust boundary for each class of claim, since that sets the ceiling on every claim built above it, and setting retention and access policy for private evidence, since prompts and traces can be re-identified even after hashing, so a receipt kept indefinitely for audit is also a privacy liability kept indefinitely.

Money and risk concentrate in three places: the engineering cost of capture, key management and causal experiments, the downstream cost when a false but signed claim passes silently into a decision, and the exposure when an irreversible action runs on semantic truth assumed rather than tested. The scale of the middle risk is easy to underestimate from one flagged case. At a realistic low prevalence, a detector with 95 percent sensitivity and a 1 percent false-positive rate can still leave the true share of its flagged cases under 9 percent, an illustrative calculation, not a measured result from any study here. The 2026 evidence supports that authenticity is not truth and availability is not reliance. It does not yet support a return figure, since no study here executed a cryptographic implementation, a spoofing experiment or an internal causal intervention, and it does not yet support a general, privacy-preserving causal-attestation capability for open natural-language computation under untrusted intermediaries, an unresolved bridge, not a delivered result.