PaperlayerView exact revision on arXiv

Source-linked AI summary

Change-Provenant Supervision: Governing Learned Artifacts Under Policy Change

Jesus Salas

arXiv:2609.28574v1cs.SE

TL;DR

A learned artifact may retain supervision admitted under superseded authority, and sampled behavior cannot establish its training ancestry. The paper separates lineage-based impact scoping from independent revalidation of every retained target; a controlled harness and actual adapters demonstrate distinct properties of that design.

  • Problem

    A recorded dependency graph cannot certify that it contains no omitted edge, while output testing does not establish whether an artifact’s supervision remains admissible under current authority.

    Source: §1 · p. 1, §2.3 · p. 3, §7.2 · p. 10

  • Method

    The design uses lineage to propose impact scope and explanation, then independently revalidates every retained target against the declared current contract, with evidence from actual adapters and a controlled harness.

    Source: §1 · p. 2, §2.1 · p. 3, §2.3 · p. 3

  • Results

    In the controlled harness, lineage matched document-wide semantic recall with 56 rather than 120 candidates; actual LoRAs supported byte-level custody and sealed target-level admission decisions.

    Source: §1 · p. 2, §10 · p. 13

  • Takeaways & Limitations

    The results support separating lineage-based impact work from the final admission check, whose soundness is relative to the declared contract.

    Source: §2.3 · p. 3, §10 · p. 13

    The study does not prove that the declared contract captures institutional intent, and ambiguous or open-world authority may require human adjudication.

    Source: §8 · p. 11

Abstract

from arXiv · show

A recorded dependency graph cannot certify that it contains no omitted edge. For learned artifacts, graph-scoped invalidation therefore cannot by itself justify admission after authority changes, especially when output testing misses a provenance-stale derivation. We separate recorded lineage, which proposes impact scope and a dependency explanation, from independent current-contract revalidation of every retained target, which supplies soundness relative to the declared contract. We evaluate this design in two evidence layers. Four Qwen3-14B LoRA packages bind 1.028 GB of adapter bytes to training and authority records. Stale and full-fresh adapters trained on mutually exclusive versioned supervision emitted identical plans on all 80 tested authority-neutral inputs. Byte-derived reconstruction and a sealed current-contract ledger nevertheless refused the stale and naive-append packages and admitted full-fresh and lineage-selective packages. In a controlled harness with six role-separated amendments, transitive lineage recovered all 40 semantically invalidated amendment-target pairs while nominating 56 impact candidates, compared with 120 under document-wide invalidation. All 56 had a declared path to an amended clause, although 16 remained content-valid. Omitting one load-bearing edge per amendment reduced semantic recall to 34/40 while independent revalidation refused all six affected packages. The results establish properties of a controlled governance mechanism, not an enterprise invalidation rate, unlearning result, operationally optimal workflow, or measured total-cost reduction.

1 Introduction

Learned artifacts can retain supervision admitted under authority that has since changed, even when their tested outputs appear acceptable. The paper separates lineage-based impact selection from independent revalidation of every retained target.

1 Introduction

  • Identical behavior on a test set can mask materially different derivations, including supervision admitted under superseded authority.The paper therefore treats behavioral equivalence as distinct from provenance-current admission.Source: §1 · p. 1
  • A recorded dependency graph cannot certify its own completeness, so graph-scoped invalidation alone cannot establish safe admission after authority changes.An omitted dependency can leave stale supervision outside the selected set.Source: §1 · p. 2
  • The evaluation separates real-adapter custody and admission evidence from controlled-harness semantic precision and recall evidence.Four Qwen3-14B LoRA packages support the artifact-substrate demonstration; the controlled harness examines six role-separated amendments.Source: §1 · p. 2
  • The proposed lifecycle uses lineage to scope and explain likely impact, while an independent current-contract gate validates all retained supervision.The final admission boundary is not limited by the graph-derived invalidation set.Source: §1 · p. 2
  • The claims exclude machine unlearning, enterprise transfer, and measured total-cost savings.The work tests refusal or fresh rebuilding after authority changes, not behavioral correction or improved accuracy.Source: §1 · p. 2

2 Problem Formulation

The formulation distinguishes an artifact’s recorded training ancestry from whether its retained targets still satisfy the authority currently governing them. Because a recorded graph cannot reveal its own omitted dependencies, it cannot alone bound safe invalidation.

2.1 Versioned supervision and learned artifacts

  • A target is current-contract admissible when its output passes the verifier under the amended authority; an artifact is provenance-current only when every retained target is reconstructable and admissible.This target-level semantic check is stricter than finite-set output testing of the learned artifact.Source: §2.1 · p. 3
  • The four response controls are stale retention, naive append, full-fresh rebuilding, and lineage-selective rebuilding.The first two retain v1 supervision; the latter two reacquire supervision under v2.Source: §2.1 · p. 3
  • None of the response controls performs weight-level deletion or post-hoc editing of an existing model.The fresh-rebuild controls instead create a new artifact.Source: §2.1 · p. 3

2.2 Behavior does not certify derivation

  • Stale-v1 and full-v2 adapters trained on mutually exclusive targets produced identical plans on all 80 tested authority-neutral cases.This is an existential observation, not a frequency estimate.Source: §2.2 · p. 3
  • A behavioral suite samples outputs but does not reconstruct training ancestry, so admission must inspect the artifact’s derivation directly.A current-looking sampled output does not establish which supervision produced the artifact.Source: §2.2 · p. 3

2.3 Why a lineage graph cannot certify itself

  • The same recorded graph can represent either complete dependencies or a world with an unrecorded load-bearing edge.An invalidation procedure receiving only that graph and amendment must select identically in both worlds.Source: §2.3 · p. 3
  • No traversal over the recorded graph alone can distinguish those dependency worlds; this is an information limitation, not an empirical regularity.The controlled experiments illustrate the operational consequence rather than establish the structural argument.Source: §2.3 · p. 3
  • Lineage estimates and explains impact from declared dependencies, while an independent mechanism tests every target the candidate artifact retains.Where the verifier can be executed cheaply, revalidating old targets first may identify exact semantic failures, but does not reveal omitted dependencies.Source: §2.3 · pp. 3–4

3 Architecture

The architecture assigns impact selection to lineage and final contract-relative admission to an independent check. It binds artifact bytes to records and receipts, then promotes a candidate only after reconstruction and validation.

3.1 Two mechanisms, two responsibilities

  • After an amendment, transitive lineage proposes impact candidates, replacement targets are reacquired, and a fresh candidate is built before custody reconstruction and independent admission.The final gate revalidates every retained target, including those lineage classified as unaffected.Source: §3.1 · p. 4, Figure 1 · p. 4
  • Current-contract revalidation provides contract-relative soundness, while lineage provides candidate impact scope and an explanation based on declared dependency paths.Spurious lineage expands work; missing lineage risks stale retention but is intended to be caught by admission.Source: §3.1 · p. 4
  • The lineage-first ordering is not established as operationally optimal; when an executable verifier is cheap, old targets may be revalidated before rebuilding.Admission cannot succeed until every retained target is checked or covered by an independently complete contract.Source: §3.1 · p. 4

3.2 Artifact and receipt model

  • Five record classes bind authority, target outputs and dependencies, training inputs, artifact bytes, and admission decisions.The reconstructor derives training targets from bytes rather than trusting declared arm labels or expected target lists; hashes check identity while revalidation checks admissibility.Source: §3.2 · p. 4

3.3 State transitions

  • Promotion requires reconstructable records, matching hashes, current-contract passage for every retained target, and an admission event recording authority epoch and artifact identity.Failure produces refusal, with repair, reacquisition, or rebuilding remaining obligations.Source: §3.3 · p. 5

4 Method

The method separates real-adapter evidence from controlled mechanism testing, and separates graph-derived impact selection from independent assessment of current-contract admissibility. It uses role-separated amendments, a semantic replacement oracle, custody challenges, and a real-adapter bridge to test those distinct claims.

4.1 Evidence layers

  • The evidence layers are complementary: real adapters test byte-to-target reconstruction and sealed admission, while surrogates support controlled amendment and edge-omission tests.The real-adapter bridge covers one authority transition; the surrogate layer makes no model-inference or behavioral claim.Source: §4.1 · p. 5, Table 1 · p. 5, §4.6 · p. 6

4.2 Controlled amendment protocol

  • An amendment author seals six single-clause changes, while separate oracle and lineage roles independently assess frozen targets and graph-derived impact before comparing results.The oracle evaluates targets against amended verifiers without reading lineage; the lineage role derives impact without oracle labels.Source: §4.2 · p. 5

4.3 Invalidation methods

  • The semantic replacement oracle measures target-level contract failures, allowing invalidation methods to be scored for precision, recall, false retention, and unnecessary selection rather than graph reachability.Across six amendments, 40 of 480 amendment-target pairs are invalidated; document-wide invalidation selects 120 pairs, and dependency candidates can remain content-valid after revalidation.Source: §4.2 · p. 6, §4.3 · p. 6

4.4 Single-edge stress

  • A frozen single-edge stress removes one graph-selected edge per amendment and compares it with an off-path-edge control while keeping both packages structurally reconstructable.Edge selection uses topology and lexical ordering without oracle labels.Source: §4.4 · p. 6

4.5 Custody challenges

  • Custody challenges test both specificity and sensitivity through benign record variations and damaged packages, while custody remains distinct from semantic currentness.An internally consistent package can pass custody yet still require refusal if a retained target fails the current contract.Source: §4.5 · p. 6

4.6 Actual-adapter bridge

  • The actual-adapter bridge reconstructs target sets from training records, verifies package receipts and artifacts, and applies sealed target-level decisions without rerunning inference or the amended verifier.It replays a behavioral-identity diagnostic and includes controls for substituted adapter bytes, missing receipts, truncated training data, and post-admission target mutation.Source: §4.6 · pp. 6–7

5 Evaluation Questions and Controls

The evaluation asks whether output behavior can conceal provenance differences, whether lineage narrows impact selection, and whether independent admission and custody checks respond to distinct failures. Its evidence is controlled and bounded: semantic precision is a tuned mechanism result, not a population estimate.

5 Evaluation Questions and Controls

  • The evaluation tests behavioral indistinguishability, lineage scope and edge failures, independent refusal of stale retained targets, and reconstruction of actual adapter bytes.Artifact-arm comparisons are not pooled with invalidation precision and recall, and do not require different business behavior.Source: §5 · p. 7, §5.2 · p. 7

5.1 Falsifiable gates and deterministic assertions

  • The falsifiable gates require full recall from complete lineage, reduced recall under a missing edge, and refusal whenever an affected target remains.Actual-adapter decisions are deterministic integration assertions after target sets, affectedness, and the admission rule are fixed; the behavioral diagnostic is non-claim-bearing.Source: §5.1 · p. 7

5.2 Baselines and failure modes

  • Document-wide invalidation is the full-recall control, missing edges test safety, spurious edges test candidate scope, and custody variants test both specificity and sensitivity.Surface and direct-reference baselines assess whether simpler inspection could replace graph traversal.Source: §5.2 · p. 7

5.3 Evidence strength

  • The controlled semantic results are tuned mechanism evidence: the domain and implementation came from the same research program, and traversal was observed during fixture construction.The actual-adapter bridge uses four real LoRAs but covers one authority transition and replays a sealed affectedness ledger; neither evidence layer supports a population rate.Source: §5.3 · p. 7

6 Results

Complete transitive lineage recovered all semantically invalidated amendment-target pairs with fewer candidates than document-wide invalidation, but one omitted load-bearing edge reduced recall. Independent current-contract checks refused affected packages despite custody passes, while the actual-adapter bridge applied sealed decisions to reconstructed real packages.

6.1 A plausible package can hide one unsafe omission

  • 34/40 recall followed removal of one load-bearing edge per amendment, and independent revalidation refused all six affected packages despite their custody passes.The matched off-path omissions preserved all 40 semantic failures and passed custody and admission, showing the gate responded to stale retention rather than graph incompleteness alone.Source: Table 2 · p. 8, §6.1 · p. 8

6.2 Lineage narrows pre-revalidation impact scope

  • 40/40 semantically invalidated pairs were recovered by complete transitive lineage with 56 candidates, versus 120 for document-wide invalidation; 16 lineage candidates remained content-valid.All 56 candidates had a declared path to an amended clause; the 16 content-valid candidates yield 0.714 semantic precision, not provenance accuracy.Source: Table 3 · p. 8, §6.2 · p. 8

6.3 Custody has two-sided behavior

  • Six benign custody variants were admitted and all 16 damaged packages were refused, while incomplete-lineage packages passed custody and were refused only at semantic revalidation.The tests distinguish byte integrity from current normative admissibility.Source: §6.3 · p. 9

6.4 The lifecycle operates on actual adapter bytes

  • Across four actual Qwen3-14B LoRAs, target sets came from training bytes; stale and naive-append packages retaining 32 affected targets were refused, while full-fresh and lineage-selective packages were admitted.The bridge replays a sealed affectedness ledger rather than executing a second verifier.Source: Table 4 · p. 9, §6.4 · p. 9
  • 80/80 authority-neutral inputs produced identical plans from stale and full-fresh adapters despite mutually exclusive supervision on the 32 affected cases.The frozen assessor classified this diagnostic as mixed or inconclusive; sampled output identity did not certify equal training provenance.Source: §6.4 · p. 9

7 Discussion

The discussion separates lineage’s impact-triage role from independent revalidation, which remains the final admission check. It also distinguishes provenance and current admissibility from behavior, reproducibility, and unlearning.

7.1 Safety and impact triage are different products

  • Complete lineage matched document-wide semantic recall while nominating 56 rather than 120 amendment-target pairs; all retained targets still require revalidation.The additional 16 lineage candidates remained content-valid, and omitted edges can cause failed candidates and recovery work rather than silent promotion.Source: §7.1 · pp. 9–10

7.2 What behavior can and cannot establish

  • Behavioral tests can reveal deprecated behavior when it appears, but cannot establish an artifact’s supervision, current receipts, or institutional permission.The real-adapter identity result shows that tested behavior can tie while derivations differ, rejecting behavioral equivalence as a complete admission rule.Source: §7.2 · p. 10

7.3 Impact scope and cost

  • 56 rather than 120 amendment-target pairs were selected in the tested lineage-first ordering, reducing candidate work only under positive, broadly comparable per-target costs.This is not a replacement-count advantage: exhaustive revalidation could identify the same 40 semantic failures, and the study did not compare orderings or measure their costs.Source: §7.3 · p. 10

7.4 Why hermetic builds do not settle admissibility

  • Hermetic reproducibility establishes computational closure, not current normative admissibility after authority changes from v1 to v2.The design therefore needs a current semantic contract and an admission event tied to the current authority epoch; provenance hashes alone only show that recorded packages have not changed.Source: §7.4 · p. 10

7.5 Not machine unlearning

  • The mechanism rebuilds a fresh artifact from a current training set rather than surgically removing stale influence from existing weights.The stale artifact remains an inadmissible predecessor; the governance contribution is upstream of any forget-set assumption and does not claim machine-unlearning guarantees.Source: §7.5 · pp. 10–11

7.6 Operational implication

  • Deployed models should carry reconstructable links to targets, verifiers, authority versions, and the admission event that justifies current use.Policy change becomes a governed transition of impact identification, rebuilding, verification, and issuing a new receipt.Source: §7.6 · p. 11

8 Limitations

The limitations bound the evidence to a controlled mechanism demonstration: semantic invalidation results depend on the authored fixture, and adapter and harness evidence cover different substrates. The study does not establish contract correctness, enterprise rates, unlearning, or total-cost savings.

Controlled authorship

  • The six-amendment result is a controlled mechanism demonstration, not independently authored enterprise validation.The amendment author was isolated from cases, targets, lineage, and oracle labels, but the domain, harness, and scoring implementation belonged to the same research program.Source: §8 · p. 11

Tuned semantic invalidation precision

  • The reported 0.714 semantic precision is tuned against a semantic replacement oracle, not provenance accuracy or an unbiased estimate for unseen policy changes.Structural custody results have stronger evidentiary status than this tuned precision figure.Source: §8 · p. 11

Document granularity

  • The 0.714-versus-0.333 comparison depends on the fixture’s authored 20-target-per-document partition and is not a granularity-invariant effect size.Changing document boundaries would change the document-wide selection count and precision without changing lineage.Source: §8 · p. 11

Split substrates

  • Actual Qwen3-14B adapters establish behavioral non-certification and custody replay, while six-amendment semantic precision, recall, and edge-omission results use CPU surrogates.The adapter bridge replays sealed decisions rather than re-executing the amended verifier; 0.714 semantic precision was not replicated on trained adapters.Source: §8 · p. 11

Contract correctness and lineage capture

  • Independent revalidation enforces only the declared contract; the study does not prove that contract captures institutional intent, and ambiguous authority may require human adjudication.Missing-edge revalidation can catch stale targets only when it tests them directly; repairing the omitted causal explanation still requires improved provenance capture or human investigation.Source: §8 · p. 11

Scope of claims

  • The study establishes no enterprise population rates, behavioral masking rates, machine-unlearning result, or measured total-cost reduction.The 56-versus-120 comparison is pre-revalidation scope in a lineage-first workflow; exhaustive prior screening could identify the same 40 failures, and workload costs were not measured.Source: §8 · pp. 11–12

9 Related Work

Related work supplies analogies and foundations in dependency tracking, provenance, and learned-artifact lifecycle systems. This paper focuses on whether supervision remains admissible after authority changes, using independent current-contract checks in addition to lineage.

Build systems and incremental maintenance

  • Build systems and incremental view maintenance use dependencies to identify outputs affected by changed inputs, but computational reproducibility does not settle institutional admissibility.The paper adopts dependency-directed reasoning while adding a current-contract admission gate.Source: §9 · p. 12

Data provenance

  • Database provenance and W3C PROV provide concepts for describing where results derive from and which entities, activities, and people produced them.The paper applies that broad provenance intuition to authority, targets, training events, and artifacts, with independent semantic revalidation guarding against incomplete lineage.Source: §9 · p. 12

Machine-learning lifecycle provenance

  • ML lifecycle systems represent datasets, workflows, and artifacts, while fine-grained provenance can support forget-set derivation after contributor revocation.This paper instead addresses authority changes that make previously admitted targets inadmissible, requiring current-contract coverage independent of lineage.Source: §9 · p. 12

Machine unlearning and governed workflows

  • Unlearning and model editing address removal or editing of training influence, generally after a request identifies content; this work is upstream, deriving affected targets from authority provenance and governing replacement admission.Governed-workflow studies cover task-state change provenance and verifier-selected supervision; this work applies change provenance to learned artifacts.Source: §9 · p. 12

10 Conclusion

Learned artifacts can have stale supervision despite plausible behavior, and recorded lineage can omit the edge that would reveal it. The paper combines lineage-based impact scope with independent revalidation, demonstrating the mechanism in controlled tests while limiting its claims to that scope.

10 Conclusion

  • A plausible output or internally consistent graph cannot establish that an artifact’s supervision provenance is current.A missing dependency may conceal staleness from lineage-based impact analysis.Source: §10 · p. 13
  • 56 rather than 120 amendment-target pairs were nominated in the six-amendment harness, while omitting one load-bearing edge per amendment left all six packages custody-valid but failed independent admission.The exact semantic replacement set contained 40 pairs, and 16 of the 56 lineage candidates remained content-valid.Source: §10 · p. 13
  • The results establish a controlled mechanism property, not an enterprise rate or unlearning result; deployed learned artifacts need authority-linked lineage, checkable custody, and a current admission receipt.The four-adapter evidence showed identical plans on tested inputs despite different derivations, while custody and a sealed current-contract ledger distinguished stale from current packages.Source: §10 · p. 13

A Claim and Evidence Boundaries

Table 5 records the permitted interpretation of each evidence layer and guards against treating fixture counts as population claims.

A Claim and Evidence Boundaries

Related papers

Loading 2609.28574v1…