Abstract
This disclosure describes a method by which anyone can verify which data an AI model learned from, without trusting the operator that trained it. Training and fine-tuning jobs run inside hardware-isolated, attestable enclaves in a governed custody system. At the end of each job, the enclave itself signs a record that binds together the measurement of the code it ran, the capability under which the job was admitted, the identifiers of the deposits it used, the identifier of the parent model, if any, and the hash of the model it produced. This record is the model's birth certificate. It is written to a lineage registry and to a tamper-evident ledger, and it is carried in the model's portable credential, so that the model's origin travels with it. Birth certificates chain: a fine-tuned model's certificate names its parent's certificate, so a model's full ancestry can be followed back to its first training data. A verifier checks the enclave's attestation against certified measurements, the signatures, the ledger entry and its witnesses, and the current status of every deposit named. Deposits are identified by content hashes, so lineage can be proven without revealing the data. When a deposit is withdrawn, every certificate that names it, directly or through ancestry, shows that remediation is required until a new certificate is issued for the remediated model.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Wang, Edward D. H., "SI Data Bank™: Cryptographic Lineage of AI Models through a Birth Certificate Signed by the Attested Enclave that Trained Them and Carried in the Model's Portable Credential", Technical Disclosure Commons, (October 13, 2026)
https://www.tdcommons.org/dpubs_series/12166