Verifiable Silence for AI Training Disclosure

1. Abstract

Regulators, courts and the public increasingly need to establish not what an AI provider said about its training data, but what it had not said, and for how long. Presence is easy to prove: a disclosure is published, hashed, timestamped. Absence is hard: an absence has no document, no author and no date, and the party who could produce one has every incentive not to.

Crovia runs TACET, a protocol and a live public service that turns the absence of disclosure into a verifiable object. Every hour a public randomness beacon opens an epoch. An observer fetches the public model cards of the AI systems under watch, runs a versioned, published predicate over the bytes (does this card name its training data?), signs each result, and commits all of them to one sparse Merkle map. The map root, the beacon and the Merkle root of the hour's snapshots are signed into an epoch sheet whose hash is timestamped in Bitcoin. A silence proof is the chain of non-inclusion proofs for one model across a range of anchored epochs, together with the negative snapshots that justify each hour. Anyone can verify it offline; nobody has to trust Crovia.

2. The problem: absence has no witness

Article 53 of the EU AI Act requires providers of general-purpose models to publish a sufficiently detailed summary of training content. Similar duties are emerging in other jurisdictions and in private contracts (licences, indemnities, M&A warranties). Every such duty produces the same evidentiary question in dispute: when did the disclosure appear, and what was there before?

• The provider's own history is theirs to rewrite. A git history, a CMS, a model-hub README can be edited or force-pushed. Web archives are voluntary, sparse, and not designed to be adversarially robust.
• Third-party indices measure presence. Transparency indices score what companies choose to publish. They do not preserve, hour by hour, what was not there.
• A screenshot is not evidence of a negative. It shows one moment, from one vantage point, with no lower time bound and no proof of what was fetched.

What is missing is an independent, continuous, tamper-evident witness of absence whose output can be checked by the party it is used against. That is the specification TACET was written to.

3. TACET in one page

4. The temporal sandwich

Every epoch is bounded on both sides by things Crovia does not control.

The beacon value is included in the signed region of the sheet and in every snapshot; the sheet hash is what the OpenTimestamps proof commits to. A verifier checks that the beacon round corresponds to the epoch's start time using drand's published genesis and period, and checks the OTS proof against the Bitcoin block header independently. Crovia cannot move an observation earlier than the beacon nor later than the block; it can only omit hours, and omitted hours contribute nothing to silence (§7).

5. The verifiable map

The map is a sparse Merkle tree of depth 256 with canonical empty-subtree hashes, domain-separated leaf and node hashing, and CSC-1 canonical JSON for all values. Slot transitions are forward-only: empty → commitment → disclosure or empty → disclosure. A disclosure is never removed. The map therefore answers, for any target and any epoch, exactly one of three states: never-committed, committed-unrevealed, revealed.

Non-inclusion across consecutive epochs is delta-encoded: the proof carries a full path for the first epoch and, for each later epoch, only the siblings that changed. For a map of a few thousand targets this keeps a month-long proof in the tens of kilobytes.

6. Surfaces and the public predicate

The primary surface for a Hugging Face model is https://huggingface.co/<org>/<model>/raw/main/README.md; the rendered model page is the fallback. The predicate examines YAML front-matter (datasets:), headings that name training data, and lead phrases in prose. It is deliberately permissive: a thin disclosure counts as present. TACET records absence; it does not grade quality.

The predicate's source is published in the countersign repository with real-card conformance vectors; its SHA-256 is recorded in every snapshot. A disagreement about a verdict is a disagreement about public code on public bytes — reproducible by either party.

7. Silence proofs and strength levels

The monotonicity rule

observed_epochs = #{ e : sheet(e).closed.status == "bitcoin" ∧ ∃ negative snapshot for target in e }
silence_seconds = Σ over observed epochs of (epoch_end − epoch_start)
silence_days    = silence_seconds / 86400

Hours without a negative snapshot — observer down, surface unreachable, predicate error — contribute nothing. Unanchored hours contribute nothing. Operator downtime contributes nothing. Silence cannot grow while observation is paused, and any verifier can recompute the figure from the proof alone. Every displayed silence figure carries its observed_to.

8. Crovia Seal: the envelope

Every TACET proof and every certificate is delivered as a crovia.seal.v1 object — the tamper-evident receipt format specified in IETF Internet-Draft draft-crovia-seal: CSC-1 canonicalization, Ed25519 signature, issuer identity, hash of the payload, optional hash-chain and countersignatures. The draft is frozen; TACET uses it unmodified, as a profile. The same envelope is used by Causari for a different payload, which is the point of a standard.

# three lines, offline
from crovia_seal import verify_seal
seal = json.load(open("mistralai__Mistral-7B-v0.1.seal.json"))
print(verify_seal(seal, trust_root))   # signature, canonical form, payload hash

9. LACUNA certificates

A LACUNA (loss-of-auditability) certificate is a TACET level-2 silence proof for a named model and a named window, wrapped in a Seal that Crovia signs as issuer, delivered with the archived surface bytes, the predicate source at the recorded hash, and a counsel-facing narrative that states exactly what is and is not asserted. Public candidates — every model with anchored negative hours — are listed live at /registry/lacuna/; the proofs themselves are free under CC-BY-4.0. The certificate service is the paid, human part: window selection, packaging, declaration, and availability to explain the method.

A LACUNA certificate is not a fraud finding, not a statement that evidence never existed, not a claim of bad faith, not a compliance certification and not a quality grade. It is a record of what an independent observer saw, when, bounded by two public clocks.

10. Commit-then-reveal for providers

TACET is symmetric. A provider that wants protection against silence claims can pre-register a training-data summary: publish a Seal over H(summary ‖ salt), have it inserted into its slot as a commitment, and reveal the summary at release. The temporal sandwich then proves timely, unchanged publication without depending on Crovia's honesty, and a silence proof for that slot becomes impossible by construction. The three states — never-committed, committed-unrevealed, revealed — are reported as such.

11. The 2026 archive

From January to June 2026 Crovia operated a first-generation stack (the "AXIOM ledger": autonomous collectors, signed envelopes, batch Merkle seals, OpenTimestamps anchors) and a set of derived products — a transparency index, provenance graph, per-model passports, compliance timelines. Observation on that ledger paused on 2026-06-01. Its data remains public and verifiable under /registry/data/substrate/ and is browsable through Explore, Verify, Compliance and Provenance. Its silence figures are observation-bounded and stop at the last observation.

The archive is why TACET exists in its current form. Three lessons from it are now normative: silence must not accrue without observation; headline numbers must be recomputable from public files; and every product name must map to exactly one object. The March 2026 whitepaper describes that stack and is kept for the record.

12. Operational status

As of 2026-09-19. This table is maintained together with the site canon; a component is "live" only if its output file on this domain is updating on schedule.

13. Threat model

• Dishonest operator (Crovia). Cannot backdate (beacon), cannot postdate (Bitcoin), cannot remove a disclosure (forward-only slots), cannot fabricate a negative without producing bytes and a predicate verdict that anyone can re-run. Can omit hours; omitted hours count as nothing. Can stop; silence stops with it.
• Surface manipulation by the provider. A provider may serve different bytes to different clients. Snapshots record TLS certificate and IP; level 3 adds independent witnesses from different vantage points. Until then, a level-2 proof is a proof about what was served to Crovia's observer.
• Predicate disagreement. The predicate is public and hashed; a challenger can show a specific byte string on which it disagrees with human reading. That is a bug report, not a dispute about facts, and it is why the predicate is permissive.
• Beacon or Bitcoin failure. drand outage → the epoch is not opened and is skipped. OTS/Bitcoin delay → the epoch stays pending and does not count until confirmed.
• Key compromise. Operator, observer and issuer are separate Ed25519 keys published in the trust root; rotation is a new trust root entry with the previous key signing the next. Historical sheets remain verifiable against the key that was valid at the time.

14. What Crovia does and does not claim

15. Public, professional, and money

• Public, free, CC-BY-4.0: every observation, sheet, snapshot, anchor and silence proof; every headline number and the file it is read from; the specifications, reference implementations and conformance vectors (Apache-2.0 / CC0).
• Professional, paid: signed LACUNA certificates for a named model and window (from €2,500); forensic dossiers and memorization probes for litigation and regulatory work; EU AI Act monitoring for a named portfolio; witness operation for organisations that want to countersign the log.
• No vendor money. Crovia does not accept payment from the providers it observes to alter targets, predicates or the log. Providers may use commit-then-reveal at no cost.
• Sustain: individual supporters fund observer and anchor costs; every contribution is receipted as a Seal.

16. Roadmap

17. How to verify this document's claims

# reference + operator (Python ≥ 3.10)
git clone https://github.com/croviatrust/countersign
git clone https://github.com/croviatrust/crovia-seal
pip install -e countersign/tacet/reference/python -e crovia-seal/reference/python -e countersign/tacet/operator
pip install opentimestamps-client

# the live log
curl -s https://croviatrust.com/registry/data/tacet/latest.json
curl -s https://croviatrust.com/registry/data/tacet/trust_root.json

# a proof, verified (recomputes roots, checks drand rounds, parses the OTS proofs and matches Bitcoin headers, signatures, silence)
curl -sO https://croviatrust.com/registry/data/tacet/proofs/mistralai__Mistral-7B-v0.1.seal.json
tacet-operator verify mistralai__Mistral-7B-v0.1.seal.json

The live pages at /registry/tacet/ and /registry/lacuna/ read the same files. If a number on this site cannot be recomputed from a public file, it is a bug: info@croviatrust.com.

Crovia Trust · Whitepaper v3.0 · 2026-09-19 · Text CC-BY-4.0 · Prior version: v2.0, March 2026.