PaperlayerView exact revision on arXiv

Source-linked AI summary

Empty Intersection: Provenance Coverage Rose to 98% and Neither Verification Decision Moved

Dong Hyeon Jeon

arXiv:2609.30308v1cs.SE

TL;DR

This paper asks whether population-level provenance prescriptions reach verification decisions in the deployment that motivated them. It measures three interventions on a frozen snapshot and finds that none gives either decision admissible input, despite substantially wider grade coverage.

  • Problem

    The paper measures whether population-level provenance prescriptions reach decisions in a deployment where verification relied on system-written values.

    Source: §1 · pp. 1–2

  • Method

    Three interventions filter verification queries by grade, measure candidate grade vocabularies, and replay recorded writes through a grade-requiring ingress.

    Source: §1 · p. 1, §4.3 · p. 5

  • Results

    Filtering turns both decisions from pass to undetermined, while neither vocabulary widening nor the ingress gives either decision admissible input.

    Source: §9 · pp. 11–12

  • Takeaways & Limitations

    Population coverage and decision reach are separate quantities, and coverage can improve without either decision moving.

    Source: §9 · p. 12

    The frozen snapshot supports only one decision per routine, so the results rest on two observations from one deployment.

    Source: §8 · p. 10

Abstract

from arXiv · show

Two structural defenses for provenance, a grade on every row, so that a verification routine cannot mistake the system's own output for an observation, and a single write ingress, so that the grade is enforced rather than merely conventional, were measured against the production deployment that motivated them, over a frozen snapshot of 194,620 rows and the two verification decisions the snapshot supports. Neither reaches either decision. Both were prescribed by a companion paper, which diagnosed that deployment: its verification routines decided outcomes using values the system itself had written. Neither prescription is new: both are established practice in fields that do not cite one another, and no prior work measuring whether either changes a verdict was found, so what is offered here is the measurement and not the prescriptions. Filtering the verification queries by grade turns both decisions from pass to undetermined; widening the grade vocabulary raises classified coverage from 36.1% to 98.4%; a single ingress requiring a grade refuses 3,070 writes. None of the three gives either decision admissible input. The prescriptions do not fail at what they specify. Each is stated over the population and makes no reference to any decision, so neither says which rows a decision will read, and the rows each intervention repairs and the 32 rows the decisions read do not intersect. The intervention that changed the most rows shows the reach most plainly: all 121,296 rows it moved from unnameable to named fall outside both query windows. This paper reports the conditions, measured rather than designed, under which the decisions would have admissible input at all, and notes that the two decisions are blocked for different reasons.

1 Introduction

This paper measures two population-level provenance prescriptions against the deployment that motivated them. The interventions change coverage and verification outputs, but none supplies either decision with admissible input.

1 Introduction

  • 24 of 24 values used by one decision were system-written, while its relational counterpart read none of the 45 rows produced for the same remediation and reported success.The measurements use the frozen deployment snapshot that motivated the prescriptions.Source: §1 · p. 1
  • The interventions filter queries by grade, widen the grade vocabulary, and require grades at a single ingress; together they measure how far the prescriptions reach.The paper reports that the prescriptions are established practice, not its invention, and that its contribution is measurement.Source: §1 · p. 1, §1.1 · p. 2
  • None of the three interventions gives either decision admissible input, because the rows they repair do not intersect the 32 rows the decisions read.The prescriptions apply to the population without specifying which rows a decision will consume.Source: §1 · pp. 1–2

1.1 Contributions

  • The contribution includes a four-path decomposition of all 194,620 rows and a 98.4% coverage ceiling set by an absent record, not vocabulary choice.The paper also enumerates measured conditions for admissible input and finds the two decisions blocked for different reasons.Source: §1.1 · p. 2

2 Setting and Method

The measurements use a frozen snapshot restored into disposable containers, with the production deployment left untouched. The population is traced to its production paths, and identifying deployment details are anonymized.

2.1 What is measured against

  • All measurements use the frozen snapshot restored into disposable containers; the production deployment was not started, and interventions replayed recorded writes rather than executing them.Before each intervention, the restored state had to pass 33 of 33 snapshot checks.Source: §2.1 · p. 2

2.2 The population and how it was produced

  • The two decision tables contain 194,620 rows traced to their producers, while the observed-versus-derived distinction has only one side because no observing producer exists in the repository.The production paths are separated by whether values depend on previous values and, for independent values, whether they interpolate or draw around a reference.Source: §2.2 · p. 3

2.3 Anonymization

  • The deployment’s identifying names, domain vocabulary, physical units, values, and infrastructure details are replaced, while measured values remain unchanged and unrounded.The paper states that its argument does not depend on the anonymized details.Source: §2.3 · p. 3

3 The Prescriptions Under Test

The paper tests two structural prescriptions as written: provenance grades on rows and a single enforced write ingress. It asks whether these population-level measures reach the decisions that the companion paper found relying on system-written values.

3 The Prescriptions Under Test

  • A provenance grade labels rows as raw, derived, or interpolated so verification cannot mistake system output for observation; a write gateway makes the grade enforceable.The deployment had twelve write paths and none passed through a validating entry point.Source: §3 · pp. 3–4

3.1 What a measurement of these has to answer

  • The prescriptions apply to the population, not the decisions, so the paper measures whether their effects reach the rows those decisions consume.The three interventions filter queries, measure candidate grade vocabularies, and replay writes through a single ingress.Source: §3.1 · p. 4

3.2 The defect they target is present

  • One decision rests on 24 system-written values, while the relational counterpart reads none of the 45 rows produced for the same remediation and reports success on other rows.The snapshot’s relational decision returns eight stateful rows instead.Source: §3.2 · p. 4

4 Three Interventions

The three interventions alter query admissibility, population coverage, and write validation, but none supplies either decision with admissible input. Their results also expose limits in what post-hoc grading and stage replays establish.

4.2 I1 — deciding the grade vocabulary by measurement

  • Three candidate vocabularies partition the population identically, and coverage stops at 98.4% because 1.5774% of rows lack any record of what produced them.The ceiling is set by the absent record rather than vocabulary design.Source: §4.2 · p. 5
  • Grades are decidable at write time in all four schemes but only partly decidable afterward, because post-hoc grading requires two window constants absent from stored fields..Source: §4.2 · p. 5

4.3 I2 — a single write ingress that requires a grade

  • The ingress validator replays recorded writes through four ordered stages; it admits 191,550 rows and rejects writes only at S1 when their producer is unnameable.Among admitted rows, 69,924 are stateful, 121,296 draw, 330 interpolated, and none observation-graded; later stages were not reached by rejected rows.Source: §4.3 · p. 5

4.1 I3 — filtering the verification queries by grade

  • Filtering the verification queries by observation grade turns both decisions from pass to undetermined; V2 still reads none of the 45 rows produced for its remediation.The duplicates added a grade predicate while keeping the original windows, thresholds, and row limits.Source: §4.1 · p. 4, §4.3 · p. 6

4.3 I2 — a single write ingress that requires a grade

  • All 32 rows consumed by the decisions pass the ingress, but none is observation-graded, and the intersection between rejected writes and decision inputs is empty.Both decisions remain undetermined.Source: §4.3 · p. 6

5 The Common Result

All three interventions leave both verification decisions without admissible input. The repaired rows do not overlap the 32 rows the decisions read, so expanded population coverage does not move them.

5 The Common Result

  • All three interventions leave both decisions without admissible input; the 32 rows they read lie outside the rows the interventions reach.Figure 1 shows I1 naming 121,296 draw rows and I2 refusing 3,070 unattributable rows, while neither touches the 32 decision-read rows.Source: Figure 1 · p. 6, §5 · p. 6, Table 5 · p. 6
  • Population coverage describes the data, whereas decision correctness depends on the state the verification routine reads.The interventions’ repaired rows and the decisions’ inputs do not overlap, so the size of a coverage improvement gives no indication that a decision will move.Source: §5 · pp. 6–7
  • I3 changes both decisions from pass to undetermined by removing all input, because its admissible set is empty in this deployment.The decisions stop rather than improve; the intervention does not reach them with something to decide on.Source: §5 · p. 6

6 Why the Decisions Do Not Move

The measured conditions for admissible input were unmet, and the two decisions are blocked for different reasons. These are necessary conditions observed in the deployment, not a proposed design.

6 Why the Decisions Do Not Move

  • Observation-graded rows number 0 across the population, so no admissible set requiring that grade can be met under any vocabulary or ingress.This is the condition all three interventions leave untouched.Source: §6 · p. 7
  • V1 needs only an admissible grade: its window contains 45 interpolated buckets against a threshold of 5, plus one stateful bucket.Table 6 states that admitting the interpolated grade gives V1 input.Source: §6 · p. 7, Table 6 · p. 7
  • V2 takes the first 8 rows by descending time, but its first verification row is at rank 69,789, leaving a gap of 69,781 rows.Widening the admissible set alone returns nothing because 69,788 later-stamped rows precede the 45 rows being verified.Source: §6 · p. 7
  • V1’s window includes 10 rows outside the remediation window, including 3 of the 24 rows it consumed.Source: §6 · p. 7
  • No admissible set, vocabulary, or ingress admits the 3,070 unattributable rows; identifying their producer is the only path, and that information is absent.Source: §6 · p. 7

6.1 The two decisions are blocked differently

  • V1 is blocked only by the missing admissible grade, while V2 also cannot reach the relevant rows because other rows arrive first.Thus, admitting interpolated rows would give V1 input, but would not by itself solve V2’s ordering problem.Source: §6.1 · p. 7
  • I1 moved 121,296 rows from unnameable to named, yet every one lies outside both query windows.The intervention that changed the most rows therefore did not reach either decision’s inputs.Source: §6.1 · p. 8

7 Related Work

Related work establishes provenance grades and single-point capture as longstanding practices, but the cited evaluations do not measure whether grades change verification decisions. This paper distinguishes evidence about derivation from a grade that travels with a datum and is checkable at admission.

7 Related Work

  • Evidence vocabularies and per-observation status codes are established conventions; the four grades used here rediscover that family rather than add to it.Examples include the Evidence and Conclusion Ontology, SDMX status codes, and provenance-aware storage metadata.Source: §7 · p. 8
  • Under the SDMX convention, an observation without an associated status may be assumed normal, which would classify the 3,070 otherwise unclassifiable rows as normal.Source: §7 · p. 8
  • Single-point provenance capture is prior art, but the cited systems observe provenance rather than refuse operations whose origin cannot be established [6].The measured ingress refused 3,070 such writes; all refusals occurred at producer registration, which cannot manufacture missing attribution.Source: §7 · pp. 8–9
  • PASS and CamFlow record causal derivation graphs, but neither carries a per-datum grade such as observed, derived, interpolated, or unattributed [6].Derivation and evidence kind are complementary axes; the latter is the one tested here.Source: §7 · p. 9
  • The cited literature measures provenance costs or data-capture properties, while no prior work measuring whether a grade changes a decision was found [6].The paper therefore measures utility rather than proposing a new prescription.Source: §7 · pp. 9–10
  • Testing research likewise distinguishes execution coverage from checked coverage, while coverage’s relationship to fault detection was low to moderate after controlling for test count.Here, classified coverage rises from 36.1% to 98.4%, yet the repaired rows have an empty intersection with the 32 rows consumed by the decisions.Source: §7 · p. 9

8 Limitations

The measurements are bounded by a single deployment and two decisions, unexercised or replay-only intervention paths, and limits on independent validation. They do not establish that the prescriptions lack value or would make decisions correct.

8 Limitations

  • Two decisions from one deployment are not a sample; deterministic replays reproduce one computation, not independent observations.The frozen snapshot supports exactly one decision per routine, and recomputation reproduces the same 270 rows exactly.Source: §8 · p. 10
  • Observation-graded rows are absent, so the filter’s admitting path never ran and its behavior with such rows remains untested.Every filtered decision reached undetermined through an empty admissible set.Source: §8 · p. 10
  • The ingress was a replay validator, not a deployed gateway, leaving its operational behavior and enforcement costs unmeasured.Batch semantics, performance, transaction boundaries, and concurrent-writer failure modes were untouched.Source: §8 · p. 10
  • The remediation routine was not executed, leaving end-to-end completion of the write path unverified.Neither this work nor the earlier work checked whether the write path completes end to end.Source: §8 · p. 10
  • One person diagnosed, prescribed, intervened, and scored the results, with no second party checking the choices or measurements.The authors note that an unflattering result offers only limited protection against motivated scoring and none against a measurement blind spot.Source: §8 · p. 11
  • The null result concerns reach, not value: effects of refused writes or newly nameable rows on other queries were not examined.The paper does not establish that those rows lack value for other decisions or later work.Source: §8 · p. 11
  • The enumerated conditions are necessary, not sufficient; providing V1 input does not establish that it would decide correctly.No measurement here supports that correctness claim.Source: §8 · p. 11
  • The deployment is anonymized, and 3,070 rows remain without identifiable producers, limiting independent confirmation of the snapshot and their origin.The production method of those rows remained unknown at the end of the study.Source: §8 · p. 11

9 Conclusion

Three interventions tested the prescriptions against a frozen deployment snapshot. Coverage improved and writes were refused, but neither verification decision gained admissible input; the measured conditions differ between the decisions.

9 Conclusion

  • Filtering turned both decisions from pass to undetermined; coverage rose from 36.1% to 98.4%, and the ingress refused 3,070 recorded writes.The wider vocabulary’s coverage ceiling was 98.4%; three of four candidate vocabularies partitioned the population identically.Source: §9 · pp. 11–12
  • Neither the wider vocabulary nor the ingress changed either decision: repaired rows and the 32 rows read did not intersect.The decisions’ rows were admitted by the ingress, contained no newly named rows, and included no observation-graded row.Source: §9 · p. 12
  • The decisions have different unmet conditions: one lacks an admissible grade, while the other also cannot reach the rows it verifies by 69,781 ranks.The conditions were enumerated from measurement rather than proposed.Source: §9 · p. 12
  • Population coverage and decision reach are separate quantities; coverage can improve substantially while reach remains unchanged.The paper measures that distance in one deployment and cautions that two decisions cannot support broad conclusions about the prescriptions’ value.Source: §9 · p. 12
Loading 2609.30308v1…