Putting a record's fingerprint on a blockchain won't stop anyone editing it. So what does it actually protect?
Does a blockchain anchor prevent tampering or only reveal it?
This explores whether anchoring a fingerprint of a record on a blockchain stops anyone from altering that record, or only lets you notice afterward that it was altered.
This explores whether a blockchain anchor stops tampering or only exposes it. The corpus says it only exposes it, and only for one narrow kind of tampering. An anchor shows that a record has not changed since the moment it was committed What can a blockchain anchor actually prove about records?. It does not lock the original log, and nothing stops someone from editing it. The edited version simply no longer matches the anchored fingerprint. That is why the agent-logging work describes anchoring as adding tamper evidence on top of conventional logging, not replacing it Can external anchoring detect tampering in agentic process logs?. The ordinary logs still have to exist and be kept safe.
The detection is also limited by what happened before the anchor. The corpus is blunt that tamper evidence does not mean truth. An anchor can't tell you when an event actually occurred, whether it was captured correctly, who was authorized to anchor it, or what caused it What can a blockchain anchor actually prove about records?. If a record is falsified or captured wrongly before it is committed, the anchor certifies the falsified version and says nothing about the earlier tampering. The anchor covers the time after commitment and nothing before it.
Two practical details make it weaker still. First, these systems usually anchor a cryptographic commitment rather than the content, so sensitive material stays off-chain Can commitments protect sensitive agent data while enabling verification?. That protects privacy, but it means the organization must keep the content itself, and the paper leaves open what deletion or access control does to the proof. If the content is lost, the fingerprint has nothing to check. Second, someone chooses which communications get anchored. The architecture mentions risk-based selection but gives no criteria and no way to detect that a critical trace was missed Who decides which agent communications get anchored?. A record that was never selected can be quietly altered, and nothing flags the gap.
This matters because people want anchoring to stand in for stronger guarantees. Anchored evidence supports reporting readiness, but the corpus says it can't substitute for the ordering, capture authenticity and causal traceability a regulator would need to confirm that human oversight actually happened Does anchored evidence actually enable regulatory compliance or just readiness?. Part of the appeal is that current reward-hacking defenses leave operators with no portable record showing a run stayed within its evaluation boundary Do current reward-hacking defenses provide reusable evidence of safety?. An anchor can supply a record that has not been altered since commitment. It can't show the run behaved well, or that what was recorded was complete and accurate.
Sources 6 notes
A blockchain anchor shows a record has not changed since commitment, but cannot verify when an event actually occurred, whether it was captured correctly, who was authorized to anchor it, or what caused it. Tamper evidence does not mean truth.
Organizations must reconstruct agent actions, establish their temporal order, and detect post-hoc changes to critical traces. External anchoring adds tamper evidence as a layer atop essential conventional logging.
By anchoring cryptographic commitments rather than content itself, organizations can achieve tamper-evident process records while keeping sensitive communications, approvals, and reasoning traces off-chain. This separates proof from disclosure but requires organizations to retain content and raises questions about deletion and access control.
The paper describes anchoring 'selected' communications and mentions 'risk-based evidence selection' but provides no mechanism for choosing what to anchor, no criteria for selection, and no method to detect when critical traces are missed. This gap leaves the selector itself as an unexamined control.
The paper names five governance uses and three regulatory regimes but supplies no provision-to-evidence mapping and omits runtime governance controls. Temporal anchoring and artifact integrity alone cannot substitute for ordering, capture authenticity, and causal traceability—the controls a regulator would need to verify human oversight actually occurred.
Show all 6 sources
Existing defenses rely on task-specific patches, prompt instructions, or post-hoc detectors, but none provide reusable evidence that a concrete run remained within its evaluation boundary. Even working defenses do not give operators a portable record of integrity.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- Peer-Preservation in Frontier Models
- interwhen: A Generalizable Framework for Steering Reasoning Models with Test-time Verification
- The Honest Quorum Problem: Epistemic Byzantine Fault Tolerance for Agentic Infrastructure
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- BAITBENCH: Measuring Agent Reward Hacking with Optional Shortcuts Planted in ML Tasks