Hash-Chained Claim Ledgers and Model-Hash-Bound Probe Registries for Tamper-Evident Mechanistic Interpretability

1. Introduction

A claim recorded against a model at one set of weights may be silently invalid against a different set. A probe direction is a property of the activation space under the weights it was validated against; the same direction under fine-tuned weights is, in general, a different direction. We propose two structures that, together, make this failure mode structurally impossible: a hash-chained claim ledger and a model-hash-bound probe registry.

2. Background

Audit trails in ML (Barreno et al., 2010; Amershi et al., 2019) emphasise the need for traceability of decisions; structural enforcement is rarer. Merkle (1979) trees and their generalisations provide collision-resistant append-only structures; blockchains (Nakamoto, 2008) adopt them for distributed ledgers. We use the simplest case: a linear chain in which each entry hashes the previous entry's digest.

3. Method

3.1 The Claim Ledger

The ledger is an append-only log. Each entry is the canonical form of a VerifiedClaim plus the digest of the previous entry:

entry_n = digest(entry_{n-1} || canonical(claim_n))

The chain is verifiable from any node forward. A retroactive edit at any node breaks the chain at all subsequent nodes. The structure is tamper-*evident*, not tamper-*proof*.

3.2 The Probe Registry

The probe registry is a versioned, model-hash-bound map:

LinearProbe {
    probe_id: str
    version: str
    task: VerificationTask
    layer: int
    model_hash: str
    direction: np.ndarray
    bias: float
    tier: EvidenceTier
    status: ProbeStatus  // ACTIVE | SHADOW | INACTIVE
}

On every read, the registry compares probe.model_hash to the current weights hash. On mismatch: status → INACTIVE, tier → E0, excluded from gating.

3.3 The Drift Loop

A DriftMonitor watches production score streams with a two-sample Kolmogorov-Smirnov statistic (Kolmogorov, 1933) against the calibration reference. On breach, the probe is auto-demoted and excluded from gating.

3.4 The Revalidation Pipeline

On weights change, the pipeline runs end-to-end: refit probes, recompute thresholds, run held-out and shifted splits, run causal-agreement tests, and (for E2) survive the red-team evasion suite.

4. Results

The 38-test suite covers both structures. Chain integrity tests verify that appending entry n+1 without entry n raises; probe binding tests verify that a weights change demotes all bound probes.

5. Discussion

The chain detects retroactive edits; it does not prevent them. The model defends against legitimate operators acting in good faith who forget that the weights have changed. The registry's model-hash binding assumes deterministic weights loading.

6. Conclusion

The hash-chained ledger and model-hash-bound registry compose to make silent probe invalidation structurally impossible.

References

Alain, G. & Bengio, Y. (2017). ICLR Workshop. / Amershi, S. et al. (2019). ICSE. / Barreno, M. et al. (2010). Machine Learning. / Geiger, A. et al. (2021). arXiv. / Kolmogorov, A. N. (1933). Giornale dell'Istituto Italiano degli Attuari. / Merkle, R. C. (1979). PhD thesis, Stanford. / Nakamoto, S. (2008). Bitcoin. / Park, P. et al. (2024). ICML.