Definition
Tamper-evident audit trail
A durable record of what a system decided and why, structured and sealed so that any change made after an entry is written can be detected. Its defining property is not that records cannot be touched, but that touching them cannot be concealed — verification either passes clean or fails openly.
Signed audit trail
A tamper-evident trail in which each entry carries a cryptographic signature over its contents. This makes the entry independently verifiable: a third party can recompute the hash and check the signature themselves, without trusting the system that produced it. A signature is the difference between "the log says so" and "here is proof."
Logged vs. signed: why "we have logs" is not enough
Most systems log. Logs are useful for debugging, but as evidence they are weak: an application log can be edited, truncated, reordered, or reconstructed after the fact, and it usually captures only a fraction of the decision context. "Trust me, the log says so" asks an auditor to trust the very party under scrutiny. A signed, tamper-evident trail removes that ask entirely.
| Ordinary log | Signed, tamper-evident trail | |
|---|---|---|
| Editable after the fact? | Yes, silently | Yes — but the edit is detectable |
| Who has to be trusted? | The party that owns the log | No one — math, not trust |
| Independently verifiable? | No | Yes — recompute the hash, check the signature |
| Captures full decision context? | Usually partial | Inputs, context, output, all under one signature |
| Holds up years later? | Only if nobody doubts it | Yes — the signature is the proof |
What a signed decision record actually contains
For the trail to be worth anything, each entry has to capture enough to reconstruct the decision, then seal all of it together:
- Inputs — the request, the instructions, and (for AI) the model and version that ran.
- Context — the exact data, documents, or retrieval results the decision was based on, plus any tool calls or lookups.
- Output — the decision, answer, or action produced.
- A cryptographic signature over all of the above, anchored so any later edit breaks verification.
Because the signature covers the whole record, you cannot quietly swap the output, edit an input, or drop an inconvenient piece of context. Change one byte and verification fails. That single property — detectable alteration — is what turns a record into evidence.
Why post-quantum (ML-DSA) specifically
The signing scheme matters because an audit trail is a long-lived asset. A signature you write today may need to hold up in a dispute or audit years from now. Classical signature schemes are vulnerable to future quantum attacks, which would let an adversary forge a signature and retroactively undermine records you thought were settled.
ML-DSA in one paragraph
ML-DSA is the Module-Lattice Digital Signature Algorithm, the signature scheme NIST standardized for the post-quantum era. It rests on lattice problems believed to resist attack even by a large quantum computer. Signing an audit record with ML-DSA means the provenance you establish today stays defensible against tomorrow's cryptanalysis — the whole point of a record meant to survive an audit horizon. Hibiscus built a tamper-evident audit trail on this foundation, and a provisional patent has been filed on the approach.
What this means for AI
An LLM hands you a confident answer whether or not it is correct, and by default leaves no durable record of how it got there. Bolt a signed, tamper-evident trail onto the system and that changes: every decision the model makes can be signed and anchored for independent audit. When an auditor, regulator, or customer asks you to show your work, you can prove exactly which model version answered, what was in the context window, what tools it called, and that none of it was altered afterward.
The order of operations in practice:
- Instrument the decision, not just the response. Capture inputs, model and version, context, and tool calls as one structured record at the moment the output is produced.
- Sign and anchor each record. Compute an ML-DSA signature over the full record and anchor it so any later modification breaks verification.
- Give auditors an independent verifier. Let a third party recompute and check signatures themselves, so trust never has to route through you.
Why regulated buyers need this
If you sell AI into regulated markets, "our model is really good" is not something your buyer can act on. Their compliance, risk, and legal teams have to show their work under audit, which means your system has to produce evidence, not just output.
- Fintech — a decision that touches money, credit, or a customer account needs a defensible record of the inputs and reasoning behind it, one that holds up when an examiner asks.
- Healthcare — outputs that inform clinical or operational decisions must be traceable and tamper-evident, because "the system said so" is not a defensible position when it is wrong.
- Federal — provenance, integrity, and independent verifiability are table stakes, and post-quantum signatures line up with where standards are heading.
In all three, the buyer is not asking whether your model is clever. They are asking whether they can defend a decision it made, months later, in front of someone with authority. A tamper-evident audit trail is how you say yes.
Want AI you can actually prove?
For production AI where every decision is captured, signed with post-quantum cryptography, and independently auditable — and where quality is backtested against ground truth — get in touch.
Email blake@hibiscus.buzz