provenance

Models arrive like dependencies and run like code. The design puts one controlled door in front of them and checks everything that walks through.

A model is a directory, not a file. Sign the whole thing, tie the signature to the pipeline that produced it, and refuse to load anything that does not match.

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

You can check the file and test the behaviour; you cannot prove a negative. The scored answer separates code-level threats from learned backdoors and is honest about what testing can find.

If two independent builds from the same source produce identical bytes, a compromised build server cannot hide. The scored answer explains how, what breaks reproducibility, and why ML needs provenance instead of bit-for-bit equality.

Code that downloads a model by name trusts whoever owns that name today. The scored answer lists the ways that trust breaks and replaces names with pinned, mirrored, verified artefacts.

A release is only as trustworthy as the weakest step a customer cannot check. The scored answer chains source, build, artefact and publication into evidence a consumer verifies automatically.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

The most similar chunk is often the one written to be retrieved. The answer adds provenance to every chunk, ranks with it outside the model, and refuses to let text declare its own authority.

Research has shown a handful of planted documents can steer targeted answers. The defence is not a detector that recognises poison; it is control over who can write, staged promotion, and a risk estimate that multiplies the stages.

Choose narrow extraction or full-text reading according to the task. Preserve source evidence and uncertainty, and enforce data audiences and action authority independently of extracted claims.

Treat a wider memory audience as a publication decision. Check the publisher, evidence, disclosure scope and version separately; repeated copies, familiar account names and a verified label do not establish all four.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.

Every poisoned example looks correctly labelled to a reviewer. The scored answer explains the mechanism, why label audits miss it, and the defences that work at the pipeline level.

A watermark is evidence of origin under conditions, not a detector of all AI text. The scored answer explains how it works, how it fails, and what claims it can support.

'Clean the dataset' is not an investigation. The answer freezes evidence, traces what changed and who could change it, tests causality by retraining, and treats the pipeline as possibly compromised too.

Signed provenance and invisible watermarks are often lumped together as 'AI detection'. They prove different things and fail in different ways, which is the whole answer.