PaperlayerView exact revision on arXiv

Source-linked AI summary

Towards Computational Provenance: Carrying Causal-State Evidence in Generated Text

Benjamin Belay

arXiv:2608.16868v1cs.CLcs.AI

TL;DR

Generated text does not inherently verify which internal computation produced an answer. This paper authenticates causally relevant states in controlled feed-forward and transformer architectures and finds that their evidence remains detectable, including 128/128 protected end-to-end evaluations.

  • Problem

    It remains unclear whether generated output can preserve verifiable evidence of a causally relevant internal state when different computations yield the same answer.

  • Method

    The authors enforce a mandatory pathway through two discrete states, authenticate the state used, and encode it in a detectable statistical pattern in otherwise matched generated text.

  • Results

    Both architectures passed 128/128 public and protected end-to-end evaluations, with the required causal pathway reproducing across five feed-forward models and three transformers.

  • Takeaways & Limitations

    These experiments provide a controlled proof of concept that authenticated evidence of a causally relevant internal state can persist in generated text even when the answer is unchanged.

  • Takeaways & Limitations

    The result is limited to a finite arithmetic task and small purpose-built architectures with explicitly constructed discrete pathways, not larger pretrained language models.

Abstract

from arXiv · show

A language model's output does not by itself provide verifiable evidence about the internal computation that produced it. We study computational provenance: whether generated text can carry detectable evidence of which causally relevant internal state occurred. We test a bounded form of this idea in two controlled architectures: a modular feed-forward neural network and a transformer-based model. Both architectures are trained on the same arithmetic task with a mandatory pathway through two discrete intermediate states, allowing different internal paths to produce the same answer. We deliberately switch between these paths, authenticate the state actually used, and let that verified state determine a subtle statistical pattern in the generated text that can later be detected. The feed-forward and transformer systems each passed all 128 matched pairs in both their public and separately sealed protected end-to-end evaluations, with the detector recovering the signal associated with the authenticated internal state. The required causal computation also reproduced across five independently trained feed-forward models and three independently trained transformers. In a separate answer-only transformer experiment, our linear probes did not recover a naturally learned intermediate state. These results provide a controlled proof of concept that information about a verified, causally relevant internal state can be preserved in generated text even when the answer is unchanged.

1 INTRODUCTION

This work introduces computational provenance as a narrower, verifiable question: whether a causally relevant internal state can be authenticated and preserved as a detectable signal in generated text. Controlled feed-forward and transformer experiments test this using arithmetic computations that produce identical answers through different internal paths.

  • Motivation: The motivating concern is that generated answers, plans, explanations, and other records may not reliably remain connected to the computation that produced them.The paper frames this connection as relevant to evaluation, process supervision, auditing, and scalable oversight.
  • Research question: Computational provenance asks whether a verified causally relevant internal state can determine a detectable signal in generated output, without reconstructing complete internal reasoning.The study distinguishes this bounded question from general deception detection.
  • Experimental construction: The experiments use modular feed-forward and transformer models trained on the same arithmetic task, with every answer passing through discrete intermediate states z2 and z3.The same prompt is run naturally and with z2 replaced, producing the same final answer through different internal paths.
  • Results: 128/128 end-to-end evaluations were achieved by a separately trained feed-forward model in both public and protected settings.The result followed reproduction of the required causal pathway across five fresh feed-forward models.
  • Results: The transformer pathway reproduced across three fresh models, and a separately reserved transformer also achieved 128/128 on the reported end-to-end evaluations.The transformer construction retained the discrete pathway and provenance mechanism while replacing the feed-forward state modules.

2 RELATED WORK

Prior work makes internal states inspectable, verifies aspects of model execution, and embeds detectable signals in generated text. Less explored is whether generated output preserves evidence of the model’s own internal computation.

  • Together, these research directions address internal-state analysis, execution verification, and output signaling, but not whether generated text carries evidence of its own internal computation.
  • Concept bottleneck models expose predefined intermediate states for inspection, intervention, and behavioral measurement, while causal-abstraction methods test whether those states play their intended causal roles.
  • Execution-verification methods establish computational correctness, trusted execution, or model identity through mathematical proofs, trusted hardware, and processed hidden representations.
  • Text watermarking embeds detectable statistical signals by biasing token choices, with newer approaches conditioning signals on written reasoning or learned model features.

3 CONSTRUCTION

The study constructs controlled arithmetic pathways in a feed-forward network and transformer, forcing computation through discrete intermediate states whose authenticated values can influence generated wording. Answer-equivalent internal paths therefore yield identical numerical outputs but potentially distinguishable state-dependent text patterns.

  • Controlled computation: Both architectures force computation through explicit discrete states z2 and z3, with no route around either state before producing the answer.The z3 module receives only z2 and d, while the answer module receives only z3.
  • Controlled computation: Modulo-8 output allows internal paths differing by 8 in z3 to produce exactly the same final answer.The construction uses values 0–15 and modulo 16 so each internal state has a corresponding state 8 values away.
  • Causal intervention: Interventions on z2 test whether the selected intermediate state causally changes z3 in both the modular feed-forward and transformer constructions.Only the selected 16-way z2 state passes to the second stage.
  • State authentication: Cryptographically protected receipts authenticate recorded intermediate states, enabling verification of the state used during each execution.Each receipt stores the recorded state and a message authentication code computed with a secret key.
  • Textual signal: Only after verification does z2 determine state-specific wording preferences, allowing equivalent computations to leave different statistical patterns in fixed-meaning text.Six variable word positions per sentence provide multiple wording choices while numerical content remains fixed.

4 EXPERIMENTAL DESIGN

The experiments separately test causal state use, state verification, and recovery of state-specific signals from generated text, then combine them in public and protected end-to-end evaluations. Matched executions hold observable generation conditions fixed while varying internal paths and authenticated intermediate states.

  • Experimental design: The study evaluates causal computation, authenticated state verification, and detector recovery separately before testing the complete pipeline on public and protected data.The verification tests include altered, replayed, reordered, mismatched, and missing records.
  • Causal tests: On 4,096 held-out inputs, models are tested for correct z2, z3, and answers before interventions replace z2 or apply answer-changing and control conditions.The primary intervention computes (z2 + 8) mod 16, intended to change z3 while preserving the answer.
  • Signal detection: Each verified z2 value selects a statistical text-generation pattern, and a fixed detector aggregates eight reports across all 16 possible states.Detection requires exceeding a separately calibrated threshold and beating every competing state score.
  • End-to-end comparison: Matched executions keep the prompt, answer, semantic content, generation settings, and position-indexed sampling draws fixed while following different internal paths.A pair succeeds only when both computations and receipts verify and the detector identifies the signal associated with the verified state.
  • Protected evaluation: Each architecture undergoes public testing and one sealed protected evaluation on 128 matched pairs with the model, detector, thresholds, and receipt rules unchanged.The protected set is reserved before training, and models must first pass public computation, causal, and end-to-end tests.
  • Answer-only transformer: A separate answer-only experiment trains three four-layer transformers to test whether intermediate states emerge without explicit supervision of z2 and z3.The models have 540,808 parameters, width 128, four attention heads, and 256-unit feed-forward blocks.

5 RESULTS

Both engineered architectures reproduced the required causal computation and achieved 128/128 on public and separately protected provenance evaluations, with authenticated internal states determining detected text signals. In answer-only transformers, linear probes failed to recover the tested intermediate state, yielding a bounded negative result.

  • Causal validation: All five feed-forward models and all three transformer models reproduced the required causal pathway.A separately reserved model of each architecture also passed all 4,096 public computation cases and all 28,672 causal cases before provenance evaluation.
  • Component validation: The answer-preserving intervention changed z3 without changing the final answer, while answer-changing interventions produced the predicted different answer and controls behaved as expected.Receipt and text-signal components were validated before integration, and detector thresholds were fixed at T = 4.041451884327381 and M = 0.
  • Feed-forward provenance: 128/128 public and 128/128 protected end-to-end evaluations were achieved by a designated feed-forward model, with detected signals changing according to authenticated z2.Natural and alternative executions preserved the prompt, answer, semantic content, and position-indexed sampling draws while following different z2 →z3 paths.
  • Transformer provenance: 128/128 public and 128/128 protected evaluations were achieved by the designated transformer, with no wrong-state confusions, no no-signal detections, and no failed reThe transformer used the same 16 authorities, text generator, detector, output count, and calibrated thresholds as the feed-forward construction.
  • Answer-only transformers: 100% overall, minimum-class, and minimum-template accuracy was achieved by three fresh answer-only transformers, but no frozen linear probe met recovery criteria at any of 20 residual sites.The best accuracy was 23.80% for the full 16-way z2 value and 45.54% for z2 mod 8; this was bounded to the tested model, locations, and probe family.

6 DISCUSSION

The experiments establish computational provenance as a controlled proof of concept across modular feed-forward and transformer architectures, combining causal intervention, authenticated state receipts, and detectable output signals. The result remains limited to purpose-built discrete pathways and constrained text generation, while answer-only transformers did not yield a naturally recoverable intermediate state.

  • Core result: Different internal paths produced the same answer while leaving detectable patterns in generated text in both controlled architectures.The causal pathway reproduced across five feed-forward models and three transformers.
  • Core result: The provenance connection required intervention evidence, authenticated receipts identifying the observed state, and a statistical signal preserving that state in generated output.A receipt or watermark alone would not establish the connection between causal computation and observable text.
  • Implications: The proposed framework would test candidate activation states causally, authenticate their occurrence, and link them to detectable output signals.This could complement interpretability and scalable oversight without recovering a model’s complete reasoning.
  • Limitations: The result is a proof of concept in a finite arithmetic task with explicitly constructed discrete states, including a small purpose-built transformer rather than a pretrained language model.It establishes transfer across architectures, not the natural emergence of provenance-ready states in pretrained models.
  • Limitations: The text-generation setup held semantic content fixed with a limited interchangeable vocabulary, leaving unrestricted, long-form, edited, or paraphrased outputs untested.The verification system also depends on trustworthy instrumentation, verifiers, and secret HMAC keys.
  • Natural-state boundary: All three answer-only transformers solved the observable task perfectly, but frozen linear probes recovered no qualifying z2 representation at 20 predefined token-level locations in the designated development model.High answer accuracy therefore did not automatically provide an internal state that could be authenticated and carried into the output.

7 CONCLUSION · A ADDITIONAL EXPERIMENTAL DETAILS

The study demonstrated computational provenance in a modular feed-forward network and an engineered transformer by linking authenticated internal states to detectable statistical patterns in generated text. The required causal pathway also reproduced across independently trained models.

  • 7 CONCLUSION: Computational provenance was demonstrated in two controlled model architectures.The architectures were a modular feed-forward network and an engineered transformer.
  • 7 CONCLUSION: The internal path changed while the prompt, final answer, semantic content, and sampling randomness remained fixed.This controlled the comparison so the differing internal path was the specified change.
  • 7 CONCLUSION: Authenticated records established which internal state was used.The records identified the state associated with each generated output.
  • 7 CONCLUSION: Generated text carried the statistical pattern corresponding to the authenticated state.The state-dependent pattern was detectable in the generated text despite the controlled conditions.
  • 7 CONCLUSION: The required causal pathway reproduced across five feed-forward models and three transformers.This reproduction occurred across independently trained models of both architectures.
  • A ADDITIONAL EXPERIMENTAL DETAILS: The supplied passage does not report an additional experiment from section A.No separate experimental-detail result is included in the provided evidence.

A.1 EVALUATION DETAILS · A.2 END-TO-END EVALUATION DETAILS · A.3 EXACT AND ABSTRACT PROVENANCE

The evaluation details verify the required causal computation through interventions and repeated training, while end-to-end tests combine execution, receipt, correctness, and detector checks. Provenance evidence is distinguished across exact receipts, abstract receipts, and statistical signals.

  • A.1 EVALUATION DETAILS: 512 natural executions produced the expected z2, z3, and answer in the selected feed-forward model’s causal confirmation.Answer-preserving, same-state, and sham interventions preserved the expected answer, whereas answer-changing, wrong-state, and direct-z3 interventions produced predicted changes.
  • A.1 EVALUATION DETAILS: After z2 replacement, the neural network still calculated z3 rather than receiving z3 from the controller.This intervention therefore preserved the network’s required downstream computation mechanism.
  • A.1 EVALUATION DETAILS: 5 freshly trained feed-forward models each met the required computation and causal criteria across 4,096 held-out inputs and 28,672 causal cases.The robustness study repeated both computation and intervention tests on every model.
  • A.2 END-TO-END EVALUATION DETAILS: 256 execution packages and 1,280 receipts composed each 128-pair end-to-end evaluation.Each evaluation included 128 natural and 128 alternative packages.
  • A.2 END-TO-END EVALUATION DETAILS: 10,240 outputs were generated per end-to-end evaluation from 40 outputs per package across state-conditioned and four control conditions.Each package received eight state-conditioned reports and eight reports under each control condition.
  • A.2 END-TO-END EVALUATION DETAILS: A matched pair passed only when both executions followed the expected computation, receipts verified, content remained correct, and the detector identified the signal.The passage defines the joint pass condition for the end-to-end evaluation.
  • A.3 EXACT AND ABSTRACT PROVENANCE: Exact receipts, abstract receipts, and statistical signals provide distinct forms of provenance evidence.These evidence types are summarized together in Table 3.

A.4 TRAINING AND CHANNEL DETAILS · A.5 ENGINEERED TRANSFORMER CONSTRUCTION

The study specifies fixed training procedures for the feed-forward models and constrained text generator, then defines an engineered transformer with separate discrete-state processing stages and a fixed provenance channel. The transformer robustness and prospective evaluations were completed under this construction, including 128/128 public and protected end-to-end provenance results.

  • A.4 TRAINING AND CHANNEL DETAILS: Feed-forward models used AdamW with learning rate 10−3, 750 warm-up steps, weight decay 10−4, batch size 256, and gradient clipping at 1.0.The schedule spanned 10,000 steps, and evaluated checkpoints were fixed at step 5,000 for the five-model robustness study and final evaluation.
  • A.4 TRAINING AND CHANNEL DETAILS: The constrained neural text generator used AdamW with learning rate 0.003, weight decay 10−4, batch size 64, ten epochs, and seed 817331.Its data comprised 320 training, 96 calibration, and 96 untouched channel-qualification semantic objects, each with eight variants.
  • A.5 ENGINEERED TRANSFORMER CONSTRUCTION: The first transformer stage maps fields a, b, and c to one of 16 discrete z2 values, while the second maps the selected z2 and d to one of 16 discrete z3 values.The answer head receives only the selected z3 value.
  • A.5 ENGINEERED TRANSFORMER CONSTRUCTION: Three fixed robustness seeds trained for 12,000 steps each passed 4,096 computation cases and 28,672 causal cases per model.A fourth prospectively designated transformer passed 128/128 public and 128/128 protected end-to-end provenance results after passing the same public computation and causal evaluations.
  • A.5 ENGINEERED TRANSFORMER CONSTRUCTION: The protected population was selected and sealed before claim-bearing training, preserving the prospective character of the protected end-to-end evaluation.This condition accompanied the fourth transformer’s 128/128 public and 128/128 protected provenance results.
  • A.5 ENGINEERED TRANSFORMER CONSTRUCTION: The transformer reused the calibrated carrier with T = 4.041451884327381, M = 0, 16 candidate authorities, eight reports per execution, 49 indexed draws per report, and 24 eligible word positions.Receipt fields were updated for the new architecture, while receipt semantics, carrier, detector, and attack families remained unchanged.

A.6 ANSWER-ONLY STATE LOCALISATION

In an answer-only transformer experiment, three models achieved perfect task accuracy, but linear probes did not recover the predefined intermediate state to the registered criteria. Consequently, the provenance mechanism was not run in this experiment.

  • Task performance: Three 540,808-parameter transformers trained with final-answer crossentropy only achieved 100% overall, minimum answer-class, and minimum template accuracy.The models used four layers, width 128, four attention heads, and 256-unit feed-forward blocks, evaluated on a frozen 4,096-row held-out split.
  • State localisation: 23.80% was the best full-z2 accuracy and 45.54% was the best z2 mod 8 accuracy, below the predefined recovery criteria.Both exceeded uniform-chance levels of 6.25% and 12.5%, respectively.
  • State localisation: 50.39% was the best within-answer state balanced accuracy, close to binary chance, and no location met all qualification criteria.Probes covered 20 predefined residual-stream locations across five token positions after each of four layers and targeted full z2, z2 mod 8, within-answer state, z3, and the answer.
  • Consequences: Because no probe location qualified, the study did not perform causal patching, examine the two reserved models, or run the provenance mechanism.The result was limited to one development seed.

A.7 PROTECTED EVALUATIONS · A.8 THREAT-MODEL MATRIX · B ADDITIONAL CONSTRUCTION AND EVALUATION DETAILS

Protected evaluations passed all 128 pairs for both feed-forward and transformer systems, while a transformer adjudication mismatch changed only the evaluator label and left the committed evidence unchanged. The supplied material also identifies a threat-model matrix, but provides no substantive construction details for section B.

  • A.7 PROTECTED EVALUATIONS: 128 protected pairs were passed by the fresh feed-forward model after public computation, causal, and end-to-end evaluations.The protected set was selected and sealed before the fixed 5,000-step training procedure.
  • A.7 PROTECTED EVALUATIONS: 128 protected pairs were passed by the engineered transformer using the unchanged text signal and detector.The set was sealed before claim-bearing training and released only after public tests.
  • A.7 PROTECTED EVALUATIONS: Both protected evaluations had no wrong-state confusions, no detections in no-signal controls, and no failed receipt or integrity checks.These checks covered both the feed-forward and transformer protected evaluations.
  • A.7 PROTECTED EVALUATIONS: A post-execution evaluator-label mismatch interrupted the transformer’s initial adjudication after primitive evidence had been committed.The issue occurred before key revelation.
  • A.7 PROTECTED EVALUATIONS: Adding the missing positive terminal changed only the evaluator label; execution, output, receipt, key, threshold, and scientific criterion remained unchanged.Production and independent reconstruction then agreed exactly on the unchanged evidence.
  • A.8 THREAT-MODEL MATRIX: The threat-model matrix is identified as covering trust assumptions and attacks considered in the evaluation.The supplied passage provides the table title but no individual assumptions or attacks.
  • B ADDITIONAL CONSTRUCTION AND EVALUATION DETAILS: No substantive passage for additional construction or evaluation details is supplied in this section block.Accordingly, section B cannot be summarized beyond its title.

B.1 MODEL ARCHITECTURE … B.4 EXAMPLE MATCHED OUTPUT PAIR

The system enforces a mandatory discrete z2 → z3 → y pathway, calibrates detection with finite-sample thresholds, and encodes verified states through cryptographically derived wording patterns. A matched example shows identical reported content despite different authenticated internal paths, producing state-dependent wording differences.

  • B.1 MODEL ARCHITECTURE: The z2 and z3 modules make single discrete selections, with z3 receiving z2 and d, while the answer head receives only z3.This preserves the mandatory z2 → z3 → y pathway.
  • B.2 DETECTOR CALIBRATION: A detected state must rank uniquely first, exceed threshold T, and score strictly above every competing state.The required separation margin was fixed at M = 0.
  • B.2 DETECTOR CALIBRATION: 2/513 ≈ 0.0039 is the combined finite-sample calibration bound for no-signal detections and wrong-state confusions.The bound applies to the registered evaluation setting, not as a universal false-positive rate.
  • B.3 REGISTERED SURFACE VOCABULARY: Each eligible position permits eight alternatives from one of six groups of interchangeable words.The generator may also include one optional phrase or omit it entirely.
  • B.3 REGISTERED SURFACE VOCABULARY: For each eligible position and verified state, four of eight alternatives are favoured using a cryptographically derived state-dependent subset.The detector relies on the accumulated pattern across the complete report, not on individual words.
  • B.4 EXAMPLE MATCHED OUTPUT PAIR: The matched example was selected deterministically as the first example under the original public evaluation’s registered ordering and reproduced verbatim.The printed z1, z2, and z3 numerical fields are fixed report content rather than the authenticated internal states.
  • B.4 EXAMPLE MATCHED OUTPUT PAIR: Paired sampling randomness makes the resulting wording differences reflect the change in authenticated internal state rather than a change in reported content.The change in authenticated z2 determines a different state-specific generation pattern.
Loading 2608.16868v1…