PaperlayerView exact revision on arXiv

Source-linked AI summary

Attestream: Usage-Aware Intermittent Data Distribution with Verifiable Lifecycle Provenance for Machine-Learning Data Streams

Kentaro Oda

arXiv:2609.07641v1cs.CRcs.DC

TL;DR

Providers of valuable data streams cannot observe whether consumers use deliveries, while idle copies enlarge the leakage surface. Attestream couples continued supply to linked, dual-signed lifecycle records, usage reporting, and fingerprint-based leak attribution. A complete daily round costs 657 k gas with plain records, and tokenization adds about 30 k gas per record.

  • Problem

    Providers cannot determine whether delivered stream data is used, while unused copies enlarge the leakage surface without producing value.

    Source: §I · p. 1

  • Method

    Attestream records preparation, delivery, derivative creation, and distribution as linked dual-signed events, gates the next delivery on timely usage reporting, and fingerprints payloads for leak attribution.

    Source: §I · p. 2

  • Results

    A complete daily round costs 657 k gas with plain records (≈$0.13 on rollups), while ERC-721 tokenization adds ~30 k gas per record.

    Source: A. On-Chain Cost (Q1, Q2) · p. 5, B. Record-Representation Ablation · p. 6

  • Takeaways & Limitations

    Conditioning the next delivery on usage reporting can shrink the leakage surface where data produces no value.

    Source: §I · p. 1

    The gate verifies registration of a derivative hash, not that it is a genuine model trained on the delivered data.

    Source: B. Limitations · p. 7

Abstract

from arXiv · show

Providers of continuously produced, commercially valuable data -- sensor streams, telemetry, and other feeds sold as machine-learning training material -- cannot observe whether delivered data is actually used, while data that keeps flowing to inactive consumers enlarges the leakage surface without producing value. We present Attestream, a blockchain-based architecture for intermittently delivered dataset streams that couples continued delivery to verifiable usage reporting. Every lifecycle event -- dataset preparation, dual-signed delivery, derivative creation (e.g., a model), and derivative distribution -- is appended to an on-chain registry as a non-repudiable, mutually linked lifecycle record. The mechanism requires provable transfer, not tokenization: plain contract storage, ERC-721 tokens, and anchored off-chain receipts are interchangeable representations of the same protocol. A usage-aware gate suspends a consumer's stream when no derivative-creation record is registered within a reporting window; evaluated lazily inside the next delivery transaction, monitoring adds no dedicated transactions. A modality-pluggable fingerprinting layer binds any leaked copy to the dual-signed delivery record of the responsible consumer, instantiated for tabular/geospatial records, images, and documents. We implement the registry as a Solidity contract with EIP-712 dual signatures and evaluate it: a full lifecycle round costs 657k gas with plain records ($0.13 on rollups; ERC-721 tokenization adds ~30k gas per record), and over a 50-consumer pool leak attribution reaches 100% from 40 leaked table rows under moderate noise, survives JPEG recompression to quality 30, and tolerates paraphrase rates up to 30% for documents.

I. INTRODUCTION

Attestream addresses providers’ inability to see whether delivered stream data is used and the risk of idle copies by conditioning continued supply on reported derivative creation. It combines linked, dual-signed lifecycle records, a lazy usage gate, and fingerprint-based leak attribution.

I. INTRODUCTION

  • A provider cannot tell whether consumers exploit delivered data, while idle copies enlarge the leakage surface without producing value.Usage information can also inform collection, pricing, and investment in sensing.Source: §I · p. 1
  • A consumer must register a signed on-chain derivative-creation record within the reporting window to receive the next delivery.The gate is evaluated lazily inside that next delivery transaction, adding no dedicated monitoring transactions or trusted off-chain monitor.Source: §I · pp. 1–2
  • Lifecycle events are dual-signed, mutually linked records that connect preparation, delivery, derivative creation, and derivative distribution.The links form delivery, data-to-derivative usage, and incremental-model lineage graphs; ERC-721 tokenization is optional.Source: §I · p. 2
  • A modality-pluggable fingerprinting layer binds leaked copies to a dual-signed delivery record across tabular/geospatial data, images, and documents.The image and document instantiations use spread-spectrum watermarking and randomized fingerprinting codes,.Source: §I · p. 2
  • The evaluation measures gas, lifecycle-round latency, lineage-query scaling, and attribution accuracy under leakage, noise, compression, paraphrasing, and collusion.The implementation is a single Solidity contract.Source: §I · p. 2

A. Blockchain Data Provenance and Sharing

  • Attestream extends blockchain provenance beyond logging primary-data access by tracking derivative artifacts and enforcing affirmative usage reports.The cited patent specifies functional units and embodiments, but not a formal gate, record-representation analysis, concrete realization, or measurements.Source: A. Blockchain Data Provenance and… · p. 2, §I · p. 2

B. Data Marketplaces and Trading

Attestream treats delivery as the start of a usage-reporting obligation, extending marketplace records to derivatives and leak accountability. Its records are verifiable through their links rather than dependent on tokenization.

B. Data Marketplaces and Trading

  • Marketplaces and trading systems treat the sale as terminal, whereas Attestream makes continued supply depend on reporting usage and adds billing hooks for derivative sales.Prior systems include on-chain matching, trusted-hardware-secured trade, and streaming records interleaved with micropayments.Source: B. Data Marketplaces and Trading · p. 2

C. Tokenized Records

  • Attestream’s lifecycle records are dual-signed events whose links provide verifiability; tokenization is optional for wallet visibility or royalty rails.The paper retains tokenization only when an ecosystem uses those features and quantifies its cost.Source: C. Tokenized Records · p. 2

D. Model and Dataset Provenance

  • Unlike voluntary off-chain datasheets and model cards,, Attestream records dataset-to-model lineage on-chain for adversarial provider–consumer settings.Lo et al. record federated-learning provenance among cooperating parties.Source: D. Model and Dataset Provenance · p. 2

E. Access and Usage Control via Smart Contracts

  • Prior access-control systems gate resource access or penalize detected misbehavior, while Attestream suspends supply when a consumer fails to act.The paper characterizes this continuous-obligation semantics as closer to usage control than access control.Source: E. Access and Usage Control via Smart… · p. 2

F. Leak Tracing and Accountability

  • Attestream combines existing fingerprinting methods behind one attribution interface with stopping unused streams and on-chain evidence tied to each fingerprinted copy’s delivery.The paper does not propose new marks; listed approaches include watermarking, fingerprinting codes,, and probabilistic attribution.Source: F. Leak Tracing and Accountability · p. 3

A. Actors and Assets

  • Consumers receive individually fingerprinted variants of each stream dataset and may use them with prior derivatives to create new derivatives.Payloads move off-chain, while the ledger stores hashes, identities, timestamps, links, and signatures.Source: A. Actors and Assets · p. 3

B. Threat Model

Attestream assumes mutually distrusting providers and consumers, with uncompromised signing keys and an available, integral ledger. Its goals span usage visibility, automatic supply discipline, non-repudiation, lineage, and leak attribution.

B. Threat Model

  • The threat model includes consumers denying receipt, using data without reporting, leaking copies, or fabricating reports, and providers denying delivery or falsely accusing consumers.Ledger integrity and availability are assumed, signing keys are not compromised, and semantic truth of usage reports is out of scope.Source: B. Threat Model · p. 3

C. Design Goals

  • The design goals are per-delivery usage visibility, automatic suspension of non-reporting streams, non-repudiation, derivative lineage, and on-chain leak attribution.The overview places the delivery gate inside TR2 registration.Source: C. Design Goals · p. 3

A. Lifecycle Records as a Linked Provenance Graph

1) Preparation (TR1):

Each consumer receives a fingerprinted delivery recorded with consent and a link to the prior delivery. Derivative records connect model creation to its input delivery and parent model, while distribution records extend signed provenance to recipients.

2) Delivery (TR2):

  • After download, the consumer’s EIP-712 consent signature is included in the provider-registered delivery record, alongside a link to the prior delivery.The per-consumer nonce prevents replay, and the confirmed record carries both parties’ signatures.Source: 2) Delivery (TR2) · p. 3

3) Derivative creation (TR3):

  • A derivative-creation record links a consumer’s model hash to the delivery it used and optionally to its prior model.The parent link makes incremental-training ancestry walkable on-chain.Source: 3) Derivative creation (TR3) · p. 3
  • When a consumer transfers a model to a recipient, the distribution record carries both the consumer’s and recipient’s signatures.This extends non-repudiation one hop down the value chain and enables royalty-style billing on derivative sales.Source: 4) Derivative distribution (TR4) · p. 3

4) Derivative distribution (TR4):

Attestream’s linked lifecycle records can use plain contract storage, optional ERC-721 tokens, or anchored off-chain receipts. Its delivery gate checks for a timely derivative acknowledgment when the next delivery is attempted.

4) Derivative distribution (TR4):

  • TR4 registration is restricted to the creator of the referenced derivative, and references are checked for type and ownership to keep the on-chain graph well-formed.TR1 and TR2 are provider-registered; TR2 also requires consumer consent, while TR3 is registered by the consumer named in the delivery.Source: 4) Derivative distribution (TR4) · p. 3

B. Record Representation

  • The record store needs integrity, non-repudiation, linkability, and queryable availability, but does not require token semantics.The paper treats representation as a deployment choice, ranging from audited database records to NFTs.Source: B. Record Representation · p. 4

1) Plain contract records (default):

  • Plain contract records store each record as a contract struct plus an event, with sequence numbers as identifiers.This is the minimal on-chain realization and the cheapest representation.Source: 1) Plain contract records (default) · p. 4

2) ERC-721 tokenization (optional):

C. The Usage-Aware Delivery Gate

  • After the reporting window lapses without acknowledgment, delivery attempts fail and the stream is suspended until the provider reinstates it.A late derivative record does not reopen the gate automatically.Source: C. The Usage-Aware Delivery Gate · p. 4
  • The gate evaluates delivery eligibility lazily inside the next delivery transaction, avoiding dedicated monitoring transactions and a trusted off-chain monitor.The gate predicate depends on stored state and the current block timestamp.Source: C. The Usage-Aware Delivery Gate · p. 4

D. Modality-Pluggable Fingerprinting and Leak Attribution

Attestream places modality-specific fingerprint embedders behind one attribution interface. Each embedder derives a consumer-specific variant from a master dataset and a consumer key.

  • A keyed embedder maps a master dataset and consumer key to a consumer-specific variant, with fidelity, robustness, and distinguishability as design properties.The contract sees only the variant’s hash, making the on-chain side modality-agnostic.Source: D. Modality-Pluggable Fingerprinting… · p. 4
  • The same attribution pipeline covers tables, images, and documents through a pluggable fingerprinting abstraction.The paper instantiates the embedder for three modalities.Source: D. Modality-Pluggable Fingerprinting… · p. 4

1) Tabular and geospatial records (the patent’s embodiment):

The paper instantiates fingerprinting separately for tabular and geospatial records, images, and documents. Across modalities, the provider can link a leaked copy to a dual-signed delivery record.

1) Tabular and geospatial records (the patent’s embodiment):

  • For geotagged records, keyed zero-mean Gaussian noise perturbs latitude and longitude by approximately 55 m, within typical sensor tolerance.Other error-tolerant numeric attributes can carry the mark, and attribution matches leaked rows against expected variants by mean squared error.Source: 1) Tabular and geospatial records (the… · p. 4

2) Images:

  • For images, a keyed spread-spectrum watermark modifies perceptually significant mid-frequency DCT coefficients and is designed to survive compression, filtering, and requantization.The prototype uses α = 0.1 and M = 4096 coefficients.Source: 2) Images · pp. 4–5

3) Documents:

  • For documents, randomized codewords select among meaning-preserving textual variants, and the code-based formulation provides resistance to small colluding coalitions.Attribution scores agreement between visible sites in a leaked excerpt and candidate codewords.Source: 3) Documents · p. 5
  • The consumer’s co-signed delivery hash links the fingerprint to the received copy, preventing a claim that the mark was planted after delivery.The provider presents the dual-signed delivery record as evidence for attribution.Source: 3) Documents · p. 5

E. Billing Hooks

Delivery and derivative-distribution records provide evidence for per-delivery charging and revenue sharing, while settlement remains outside the implemented record system. The prototype implements two registry variants and tests their lifecycle and gate behavior.

E. Billing Hooks

  • Delivery and derivative-distribution records can support per-delivery charging and revenue sharing on derivative sales, with settlement handled off-chain or through escrow.The implementation covers records only and treats settlement as orthogonal.Source: E. Billing Hooks · p. 5

V. IMPLEMENTATION

  • The Solidity prototype stores lifecycle fields and links, tracks per-stream acknowledgment state, and uses EIP-712 consent signatures with per-consumer nonces.It implements plain-record and ERC-721 variants on a shared code path.Source: §V · p. 5
  • Across 100 lifecycle rounds, gas variation stayed below 0.1% except for first-round cold storage-slot initialization, which raised maxima by up to 13%.Source: Figure 2 · p. 5
  • All 14 property-test runs passed across the two contract variants, covering lifecycle round-trips, gate cases, lineage, and rejection of forged consent or unregistered consumers.Source: §V · p. 5

VI. EVALUATION

The evaluation measures lifecycle cost, gate overhead, representation trade-offs, and query latency. Plain records keep the full daily round’s cost lower, while the gate adds no dedicated monitoring transaction.

A. On-Chain Cost (Q1, Q2)

  • 657k gas buys a complete daily round, costing ≈$13 on Ethereum L1 or ≈$0.13 on contemporary rollups.The round includes preparation, delivery, derivative reporting, and one derivative distribution.Source: A. On-Chain Cost (Q1, Q2) · p. 5, Table I · p. 6

VI. EVALUATION

  • Costs scale linearly with consumers and rounds, and no operation touches unbounded state.Evaluation uses a local EVM node; latency figures are testbed-local upper bounds, and fingerprint trials use 50 registered consumers.Source: §VI · p. 5, A. On-Chain Cost (Q1, Q2) · p. 6

A. On-Chain Cost (Q1, Q2)

  • The lazy gate adds only a few storage reads and one comparison, eliminating a dedicated per-consumer-per-round monitoring transaction.Suspension consumes gas only on the exceptional path.Source: A. On-Chain Cost (Q1, Q2) · p. 6

B. Record-Representation Ablation

  • Dropping ERC-721 minting saves ∼30 k gas per record and 15.3% (119 k gas) per full round, without changing the gate, signatures, links, or queries.The token premium is justified only when wallet visibility, standardized custody, or royalty rails are used.Source: B. Record-Representation Ablation · p. 6

C. Latency and Query Scaling

  • A full four-transaction round takes 13.1 ms mean (p95: 18.6 ms), while lineageOf returns 100 generations in under 50 ms.The local contract logic sustains >75 rounds/s per process; real deployments are bounded by block production.Source: C. Latency and Query Scaling · p. 6

D. Fingerprint Attribution Across Modalities (Q3)

Across tabular records, images, and documents, Attestream’s fingerprinting tests show attribution under partial leakage and degradation. Accuracy depends on leak volume and fidelity, and identifications are backed by the consumer’s co-signed delivery record.

1) Tabular/geospatial records:

  • At λ = 2, attribution reaches 97% accuracy from 40 rows and 100% from 100 rows; at λ = 4, 200+ rows still yield 99%.At λ ≤1, attribution is essentially perfect from 10–20 rows; small-leak attribution fails at λ = 4 when positional quality is severely degraded.Source: 1) Tabular/geospatial records · p. 6, Figure 4 · p. 6

2) Images:

  • Image attribution remains at 100% under every tested attack, including JPEG re-compression to quality 30, pixel noise, downscaling, and a combined attack.Marked copies have mean PSNR 53.1 dB and minimum PSNR 52.3 dB.Source: 2) Images · p. 6, Figure 5 · p. 7

3) Documents:

  • With half the document visible, attribution withstands p = 0.3 paraphrasing at 100%; two-consumer collusion yields a colluder in 96.8% of trials from 40 sites.With 40 visible sites, attribution is 94% accurate under p = 0.2; collusion recovery reaches 100% from 100 sites.Source: 3) Documents · pp. 6–7, Figure 6 · p. 7
  • Across all three modalities, attribution accuracy grows with leak volume and fidelity, and each identification is backed by the consumer’s delivery co-signature.Source: 3) Documents · p. 7

VII. DISCUSSION

The discussion frames Attestream as a dual-signed lifecycle registry with continued supply conditioned on timely, attributable usage reporting. It reports prototype feasibility while distinguishing auditable usage commitments from verified training.

A. Security Properties

  • Dual signatures make deliveries non-repudiable, while consumer signatures and consensus timestamps prevent forged acknowledgments or fabricated missed windows.Source: A. Security Properties · p. 7

B. Limitations

  • The gate verifies derivative-hash registration, not genuine model training; consumers can keep streams flowing with junk hashes at ≈177 k gas per round.Evaluated embedders remain vulnerable to stronger modality-specific attacks; public-chain records expose pseudonymous activity patterns, and transitive enforcement beyond direct counterparties remains open.Source: B. Limitations · p. 7

C. Deployment Considerations

  • Permissioned EVM chains offer negligible marginal cost and validator control, while public rollups provide stronger neutrality at ≈$0.13 per round.The reporting window, delivery cadence, and fingerprint scale are per-stream parameters.Source: C. Deployment Considerations · p. 7

VIII. CONCLUSION

  • Attestream links lifecycle events in dual-signed, mutually linked verifiable records and conditions continued supply on timely, attributable usage reporting.Source: §VIII · p. 7
  • ∼776 k gas per lifecycle round accompanies monitoring without dedicated transactions and near-perfect leak attribution across tabular, image, and document payloads.The reported attribution holds for small, degraded fractions of a fingerprinted delivery.Source: §VIII · p. 8
Loading 2609.07641v1…