Revocation

Today, when data has to come out of an AI system, there is no clean way to do it. A patient withdraws consent. A dataset turns out to be poisoned. A court orders something removed. But the data was already absorbed into the model's weights, copied into fine-tunes, distilled into smaller models, and cached inside agents. Nobody can say which models touched it, and nobody can pull it back. The door only opens one way.

This demonstration shows the way back. If every grant of data is cryptographically bound to the artifact that consumed it, and every binding is written to a shared ledger from the very first grant, then revocation becomes a lookup. The ledger names every downstream model, fine-tune, distillation, and agent that touched the data, and the system remediates each one, leaving a certificate a court or regulator can verify without trusting anyone.

You cannot bolt this on later. It only works if the ledger was there from the first grant. That is why this is a coalition of patents, not a feature a competitor can copy.

Three forces are converging, and they all point at the same missing capability. Regulation: privacy law increasingly treats a person's right to have their data deleted as applying to the models trained on it, not just the database it sat in. The EU AI Act, GDPR, and a growing stack of US state laws are moving that direction. Litigation: the copyright and privacy suits against foundation labs are establishing that training on data you should not have used is a real liability, and courts will want proof that it was removed. Insurance: AI liability coverage is forming right now, and underwriters cannot price or adjudicate a claim without a verifiable record of what an AI touched and when.

Here is the part that makes it urgent rather than interesting. The moment any of those forces requires provable removal, you cannot comply after the fact. The record has to have existed from the first grant of data. Whoever adopts the ledger now can comply. Whoever waits cannot catch up, because the evidence they would need was never created. That is a deadline with a moat attached.

Who pays. Foundation labs and AI platforms carrying litigation and compliance exposure. Regulated enterprises deploying AI in healthcare, finance, and government. And data owners, the hospitals, publishers, and licensors who sit on valuable data they will not release today because once it is in a model they lose all control of it.

And this is the reframe that turns it from a cost into a market. Revocation is not only a compliance expense. It unlocks data that cannot be licensed today. A hospital or a publisher will license data they would never otherwise hand over, if they can provably pull it back when the terms end or consent changes. That makes this the infrastructure for a new data-licensing market, metered per grant, not a one-time tool you sell once.

Model collapse is the failure the whole field is now worried about. When generative models are trained on data that includes AI-generated output, and then the next generation is trained on data that includes that model's output, and so on, something degrades with each pass. The rare cases at the edges of the distribution, the tails, thin out first. Diversity shrinks. The model forgets the unusual and the specific and drifts toward a confident, bland average. Run that loop enough times across an ecosystem where models increasingly train on the internet that earlier models have already flooded with synthetic text, and quality erodes for everyone, not just one lab.

The part most people miss is that model collapse is a provenance failure before it is a math failure. It almost never happens because an engineer decided to train on machine-generated slop. It happens because they could not tell it was slop. Nobody could separate original human data from AI output in a scraped corpus. Nobody could see that a dataset had been quietly contaminated with synthetic text. Nobody could notice that the model they were training was, several steps removed, being fed the descendants of its own earlier generations. The information needed to avoid collapse, where did this data come from and what is it derived from, had already been lost by the time training started. Collapse spreads in the dark, and the dark is the absence of a provenance record.

That is exactly the darkness this system removes. It does not touch what happens inside a model during training, and it does not claim to. What it does is build the record that makes the four defenses everyone already agrees on actually possible to carry out. Today those defenses are aspirations because the record does not exist. Here it does, from the first grant of data forward.

One. Provenance is scored before any data is used. Two of the eight trust dimensions the Data Trust Index measures are provenance and lineage: where a piece of data came from, and what it is descended from. A corpus that is synthetic, or model-derived, or of unknown origin scores low on precisely the dimensions that predict collapse. Because that score is computed at ingestion and recorded before the data is ever granted to a model, the contaminating material is caught at the door instead of discovered generations later when the damage is already baked into the weights. You are no longer guessing what went into training. You have a graded, recorded answer for every fraction.

Two. Recursive training is made visible. Collapse accelerates in the dark because the chain is invisible: model A produces output that ends up training model B, whose output ends up training model C, and no one is tracking that these are relatives. The provenance graph in this demo records every one of those relationships as an explicit edge, every fine-tune, every distillation, every deployed agent. The sentence "this model is being trained on data descended from its own earlier versions" stops being an invisible accident and becomes a fact you can see on a graph and query directly. You cannot manage a feedback loop you cannot see, and this is what makes the loop visible.

Three. Contaminated data is pulled back out of everything it touched. When a corpus is discovered to be contaminated, whether by poisoning, by scraped synthetic text, or by any other cause, its trust score crosses the eligibility threshold and the system revokes it automatically, then propagates that revocation to every downstream model, fine-tune, and agent that ever consumed it. This is not a hypothetical. It is the DTI-degradation scenario you can run in the demo below. Synthetic contamination that drives collapse is simply one species of the poisoning that scenario already handles, and the point is that discovery is no longer a dead end. Finding the bad data means you can actually remove it, everywhere, with proof that you did.

Four, and this is the strongest lever: AI output that identifies itself. The single most effective defense against collapse in the research is keeping synthetic data labeled and filterable, so each new trainer can exclude machine output and preserve a clean anchor of genuine human data. The problem has always been that AI output does not announce itself; once it is loose on the internet it is indistinguishable from anything else. Proof-carrying outputs change that. Content produced by an AI is born carrying a verifiable proof of its origin, checkable against the ledger, so a trainer downstream can detect it and filter it out before it poisons the next generation. This is collapse prevention at the level of the whole ecosystem rather than one model, and it is only possible because the record was there from the very first grant. It cannot be added after the content is already in the wild.

We do not change the training math, and we are careful not to claim we do. What we build is the record. It lets you score where data came from before it goes in, see every derivative relationship between models, and pull contaminated data back out of everything it touched, with proof. Everyone in AI agrees the answer to model collapse is to know your data's provenance and keep synthetic data out. Nobody can do it today, because the record that would let them does not exist. That record is exactly what this is.