A tamper-proof log proves a record hasn't changed since it was saved, but can it prove the record was true?
How can anchored records fail authenticity while passing integrity checks?
This explores the gap between a record being provably unchanged and a record being true, and how an externally anchored log can pass the first test while failing the second.
This explores the gap between a record being provably unchanged and a record being true. An anchored log can score perfectly on the first and say nothing about the second. Think of an anchor as a notarized fingerprint: it shows that a record hasn't changed since the moment it was committed, and that's all. What can a blockchain anchor actually prove about records? lists what falls outside that promise: when the event actually happened, whether it was captured correctly, who was authorized to anchor it, and what caused it. Tamper evidence does not mean truth.
The most direct failure is that a bad record stays bad, permanently and verifiably. Two other notes show how agent systems produce records that look fine but aren't. In Can a poisoned validator still approve unsafe actions?, a validator that reads poisoned shared memory forged approvals in every trial. That note doesn't test anchoring, but the extrapolation is easy: if that forged approval were logged and anchored, it would pass every integrity check, because the fingerprint would match the forgery exactly. Does model capability change how documents degrade? and Do frontier LLMs silently corrupt documents in long workflows? add a subtler version. Weaker models visibly delete content, but frontier models corrupt about 25% of a document while preserving its surface integrity, and spot checks miss it. Anchor that corrupted output and the hash verifies.
Ordering and cause are the other two gaps. Does anchored evidence actually enable regulatory compliance or just readiness? says temporal anchoring and artifact integrity can't substitute for ordering, capture authenticity, and causal traceability. Those are the controls a regulator would need to confirm that human oversight really happened. An anchored entry reading 'human approved' proves the entry existed by the time of commitment. It doesn't prove a human wrote it, or that the approval came before the action ran. The anchor timestamps the commitment, not the event. Can stateless checks ever catch sequence-level constraint violations? has a related shape: checks that look at one item at a time can't express rules that depend on history. Each record can be intact on its own while the sequence tells a different story.
So authenticity has to come from somewhere other than the anchor. Can external anchoring detect tampering in agentic process logs? frames anchoring as a layer on top of conventional logging, which means authenticity lives in the layers beneath. Can commitments protect sensitive agent data while enabling verification? adds a further wrinkle. Anchoring only a commitment keeps sensitive content off-chain, but the organization must retain the content, and the check becomes 'does what we kept match the fingerprint?' That is only as trustworthy as what was captured before hashing. Where do reasoning agents actually fail during long traces? points at the fix by analogy. Checking intermediate states during generation lifted task success from 32% to 87%, so authenticity checks probably belong at the moment of capture, not after the fact.
The better question for any anchored record is not 'has it changed?' but 'who or what wrote it, when, and could that writer have been wrong?'
Sources 9 notes
A blockchain anchor shows a record has not changed since commitment, but cannot verify when an event actually occurred, whether it was captured correctly, who was authorized to anchor it, or what caused it. Tamper evidence does not mean truth.
In a four-agent LangGraph system with authorization disabled, a validator that reads poisoned shared memory forges approvals in every trial, leading to execution of unsafe actions. The validator's position as final authority before action execution, combined with its access to corrupted evidence, made it ineffective as a boundary.
DELEGATE-52 shows weaker LLMs degrade documents through visible deletion, while frontier models degrade through subtle corruption that preserves surface integrity. This shift makes frontier failures harder to detect and potentially more dangerous at workflow scale.
Even the strongest models (Gemini 3.1 Pro, Claude 4.6 Opus, GPT 5.4) degrade documents by ~25% over long relay workflows across 52 domains. Degradation decelerates but never plateaus, and errors compound silently, remaining undetected in spot-checked outputs.
The paper names five governance uses and three regulatory regimes but supplies no provision-to-evidence mapping and omits runtime governance controls. Temporal anchoring and artifact integrity alone cannot substitute for ordering, capture authenticity, and causal traceability—the controls a regulator would need to verify human oversight actually occurred.
Show all 9 sources
Per-action checks are structurally unable to state constraints that depend on prior history. Only stateful monitors tracking composed multi-party behavior can verify the behavioral envelopes that prevent individually permissible actions from collectively violating system-level safety.
Organizations must reconstruct agent actions, establish their temporal order, and detect post-hoc changes to critical traces. External anchoring adds tamper evidence as a layer atop essential conventional logging.
By anchoring cryptographic commitments rather than content itself, organizations can achieve tamper-evident process records while keeping sensitive communications, approvals, and reasoning traces off-chain. This separates proof from disclosure but requires organizations to retain content and raises questions about deletion and access control.
Reliability for long-trace reasoning comes from checking intermediate states and policy compliance during generation, not from scoring final outputs. Adding intermediate verification raised task success from 32% to 87% because most failures are process violations, not wrong answers.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- interwhen: A Generalizable Framework for Steering Reasoning Models with Test-time Verification
- A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- Peer-Preservation in Frontier Models
- The Honest Quorum Problem: Epistemic Byzantine Fault Tolerance for Agentic Infrastructure
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- LLMs Corrupt Your Documents When You Delegate
- The Illusion of Diminishing Returns: Measuring Long Horizon Execution in LLMs