Provenance for AI outputs, not just AI media

The shift from detection to provenance

Deepfake incidents rose from roughly 500,000 in 2023 to over 8 million in 2025, and the detector arms race kept losing to better generators. The industry pivoted to provenance: attach tamper-evident credentials at the moment of creation and treat everything unsigned as unverified. The C2PA standard, backed by Adobe, Microsoft, OpenAI, Google, and others, records who made content, when, and whether AI was involved. This is the same inversion that moved security from virus signatures to code signing: stop classifying the infinite space of fakes and start authenticating the finite space of genuine origins. Provenance also changes incentives, because honest publishers gain from signing while forgers gain nothing from producing yet another unsigned file. QBC applies the philosophy one layer deeper, to the AI model itself, and pairs it with a queryable AI audit trail so the evidence is not just attached to outputs but retrievable and checkable at scale.

Content provenance vs. model provenance

C2PA and the Content Authenticity Initiative answer 'who created this file and how'. QBC answers a complementary question: 'which exact AI model produced this output, and was that model or its reasoning altered'. The two compose. A C2PA manifest can say an image was AI-generated; QBC can prove which on-chain-attested model produced a given result and commit its reasoning per block. The registry that anchors those model identities is described on the on-chain model registry page, and the hands-on procedure for checking a downloaded checkpoint against its attested manifest is on verifying AI model integrity. Content credentials without model provenance leave the deepest question open, since a signed file can still come from a tampered model; model provenance without content credentials cannot follow the file through edits and republication. Together they cover the pipeline. Model provenance is the foundation of verifiable AI.

How QBC anchors model provenance on-chain

The model QBC serves hashes to a manifest root finalised on-chain and matching its public HuggingFace release, so anyone can prove the served model is the released model; the current flagship checkpoint was attested at block 1,097,990, and the cutover is documented in the engineering log Aether v7.1 live on-chain and unified. On top of identity, every block commits a Proof-of-Thought binding the model, the reasoning context, the seed, and the output hash: a tamper-evident record of what the model did. This is provenance for cognition, and it is anchored on post-quantum rails (NIST FIPS 204). Open weights are what make the check meaningful to outsiders, a distinction unpacked on open weights vs open source; the consensus that seals each commitment is described under Proof of Thought.

Why blockchain anchoring matters for provenance

Provenance metadata is only as trustworthy as its storage; a private log can be edited. Anchoring provenance on a public blockchain makes it tamper-evident and independently checkable, which is why research is moving toward blockchain-anchored provenance registries (arXiv:2602.02412). QBC uses GRANDPA finality, explained on the GRANDPA page, so a committed provenance record is as hard to reverse as a finalised transfer. Unlike probabilistic settlement, deterministic finality gives provenance a precise moment after which it cannot be rewritten, a property unpacked on deterministic finality explained; for a court, a newsroom, or an insurer, that timestamped irreversibility is the difference between evidence and an assertion. The chain's knowledge memory is likewise content-addressed with on-chain roots (architecture on on-chain AI inference), so the context a model consulted is part of the same tamper-evident record.

Checking provenance without running a node

Provenance only scales if verification is cheap. Requiring every fact-checker, newsroom, or downstream app to operate a full blockchain node would kill adoption, which is why QBC runs BEEFY alongside GRANDPA: validators produce compact signed commitments over a Merkle Mountain Range of finalised history, and those commitments are exactly what a light client needs to confirm that a provenance record is part of the finalised chain without syncing it. The mechanism is described on light-client finality proofs. This is live infrastructure rather than roadmap: the deployment logs BEEFY live and producing commitments and BEEFY plus MMR finality proofs live record the rollout on the running network, including the operational wrinkles that only appear in production. The practical consequence: a mobile app or a browser extension can check that a model attestation or a reasoning commitment was finalised, using kilobytes of proof and no trusted intermediary.

Retrieval provenance: proving what the model read

An output's provenance is incomplete if the context that shaped it is a black box. QBC extends provenance to retrieval: the network's knowledge fabric, more than 4.2 million vectors embedded with BGE and re-ranked by a cross-encoder, is content-addressed, and its roots are committed on-chain, so the knowledge state at any block is pinned and checkable. Search returns in roughly 0.4 seconds, so verifiability does not tax usability. The design and its landing in the runtime are documented in the engineering log fabric roots on-chain, and the retrieval architecture is on verifiable RAG search. Combined with model attestation and per-block reasoning commitments, this closes the third leg of provenance: which model, what reasoning, and what sources. A disputed answer can then be audited end to end: fetch the block, check the model manifest, check the thought commitment, and confirm the retrieved context against the fabric root, all from public data.

Provenance and the coming regulation

AI-content provenance is becoming a legal requirement. EU transparency obligations require disclosure that content is AI-generated, arriving from 2026, and the EU AI Act adds traceability duties for high-risk AI from 2027. QBC anchors exactly this provenance and audit trail on-chain today, turning a converging regulatory timeline into a tailwind. For teams that must ship compliance rather than read about it, the engineering view, what to log, how to anchor it, and how to hand an auditor a proof instead of a promise, is laid out on EU AI Act compliance engineering. The important nuance is that on-chain anchoring does not replace the legal obligations; it makes fulfilling them demonstrable, which is the part regulators, counterparties, and courts actually test when a claim is challenged.

A complete provenance chain: content, model, reasoning

The strongest provenance combines layers: content credentials (C2PA) for the file, model attestation for which AI produced it, and reasoning commitments for how. QBC contributes the second and third, on a post-quantum chain, and composes with content-credential standards for the first. Signature durability matters here more than in most systems: provenance anchored with classical keys could be forged retroactively once quantum computers arrive, while QBC's records are signed with lattice cryptography, explained on Dilithium blockchain signatures, so the evidence outlives the cryptographic transition it will inevitably live through. Together these layers make an AI output's origin checkable end to end, from the file in your hand to the model and memory that produced it. The full system is on the category overview and in the SusyLabs research.