Silence in the slasher was the first warning sign.
In 2017, during a six-week audit of the Ethereum 2.0 Phase 0 slasher specification, I learned that the most dangerous condition is not the one that triggers loudly. It is the condition that never triggers at all. A slashing mechanism that never fires is not proof that validators are honest. It may simply mean the spec was written so loosely that the evidence required for a slash is never produced in a form the machine can recognize. I have carried that lesson into every protocol review since then, and it is the lens through which I read the current U.S.-China dispute over unauthorized AI model distillation.
There is no breach narrative here in the conventional sense. No stolen private key has been published. No smart contract was drained. No forensic report has shown an exact sequence of transactions that moved weights from a guarded server in San Francisco to a training cluster in Beijing. The claim is quieter and more uncomfortable: that a frontier model was not stolen but distilled, extracted through ordinary API outputs, compressed into the statistical weights of another model. Beijing calls the claim unfounded. Washington calls it unauthorized. Both statements are, in the public record, assertions without a cryptographic witness.
The Anomaly in the API Log
The first thing a serious auditor should notice is that the phrase "unauthorized AI model distillation" contains a hidden assumption. It treats a statistical learning technique as if it were an access-control event. That is a category error, and category errors are where security disasters begin.
Model distillation is not a new attack. In 2015, Hinton, Vinyals, and Dean formalized a teacher-student framework in which a smaller student model learns to match the soft probability distribution of a larger teacher model. The student never sees the teacher’s weights. It does not copy the teacher’s hidden layers. It observes the teacher’s outputs and adjusts its own parameters to reproduce those outputs as accurately as possible. This is not exfiltration in the sense of a copied database. It is a compression of behavior.
That distinction matters more than most commentators appreciate. When a closed model is distilled, the resulting artifact is not a byte-for-byte replica. It is a new model with its own parameters, its own loss landscape, and its own failure modes. The original model still exists. The attacker does not need to delete logs or obfuscate a payload, because the operation looks exactly like normal inference. The only difference is the purpose to which the outputs are later put.
From a forensic standpoint, this is an unverified edge case. The proof is in the unverified edge cases, and the edge case here is the boundary between legitimate use and training on outputs. There is no packet in the TLS stream that announces whether a language model response is about to become a training label. There is no protocol flag that says "this completion will now be backpropagated." The same bytes that produce a useful answer for a software developer can be recorded and used to fine-tune a competing model. The server has no way to distinguish a user who is learning from the answer and a user who intends to teach that answer to another machine.
Authorized by Contract, Not by Cryptography
Closed-model providers have responded to this ambiguity with terms of service rather than with technical enforcement. The terms say that outputs may not be used to develop competing models. That is a legal boundary, not a mathematical one. It depends entirely on the cooperation of the user and on after-the-fact detection. The API does not ask for a commitment before serving a response. It does not receive a zero-knowledge proof that the requester will only read the output and then forget it. No oracle exists to certify intent.
This creates a structural condition that should be deeply familiar to anyone who has audited cross-chain bridges. The security model assumes an honest counterparty at the point where the system is most exposed. In a bridge, the assumption may be that validators will not collude off-chain. In a closed AI API, the assumption is that a client with full access to model outputs will not use those outputs as training data. The American accusation says that assumption was violated. The Chinese denial says there is no proof. Technically, both the accusation and the denial can be true at different layers of abstraction. Unauthorized is a legal conclusion. Unfounded is an evidentiary claim. Neither is a cryptographic proof.
I want to be precise about the technology because the political fog is thick. Distillation does not require the attacker to obtain hidden logits or activation vectors, although those make the attack easier. A determined adversary can work with ordinary text completions. Research in model extraction has shown that even a limited number of API queries can reveal information about a model’s hidden configuration, and that asking the right questions can produce a surprisingly faithful surrogate. The model does not need to be jailbroken in the classic sense. It does not need to be tricked into revealing its system prompt. It simply needs to be asked a large and well-structured set of questions. Every answer is a signal. Every generation is an opportunity to fit a new distribution.
This is why the public framing troubles me. The U.S. statement uses language that implies an intruder crossed a security boundary. The Chinese statement uses language that implies the evidence is fabricated. The underlying technical reality is more banal: the model was almost certainly operating exactly as designed. It generated text. The generated text was useful. The generated text was then converted into supervision signal for another model. That is not an exploit of a bug. It is an exploitation of a design property.
What Distillation Actually Does
Let me walk through the mechanism in a way that maps to protocol vocabulary.
A foundation model is a function that maps a sequence of tokens to a probability distribution over the next token. The model is trained by adjusting its weights to minimize the difference between its predicted distribution and the distribution present in training data. During distillation, the student model is trained using the teacher model’s predicted distribution as the target distribution. The objective is not to memorize exact strings. The objective is to match the soft probabilities.
This is why a naive comparison of output text will fail as evidence. Two models can produce different words on every single prompt and still have the same underlying conditional distribution. Conversely, two models can produce identical text without sharing any lineage, because high-probability completions are often overdetermined. A forensic test that relies on exact matches is useless. A forensic test that relies on statistical similarity is noisy. A forensic test that requires access to both models’ internal representations is politically impossible in an international dispute.
The report I was given to analyze treated this as a defense-industrial event. It scored military capability at four out of ten, defense industry at five, and geopolitical competition at seven. That scoring pattern is interesting for what it omits. There is no data on model weights. There is no data on the number of accelerators used for training. There is no data on whether the alleged distillation was performed by a state laboratory or by a private company. The only confident conclusion is that both sides consider AI to be a strategic national security asset.
From an engineering perspective, that confidence is premature. National-security framing does not establish technical attribution. It establishes motive. It tells us that Washington believes the capability gap is large enough to protect. It tells us that Beijing believes the accusation is a political weapon. It does not tell us whether a gradient ever flowed from a teacher model to a student model.
The Missing Invariant
Blockchain auditors are trained to look for invariants. In a collateralized lending protocol, the invariant is that each loan remains overcollateralized. In a bridge, the invariant is that the total supply of bridged tokens equals the total amount locked on the source chain. In an AI training pipeline, what is the invariant?
The obvious candidate is a checksum over the model weights. We can commit to a model at a given checkpoint by hashing its parameters and recording that hash on a public ledger. That proves a specific set of weights existed at a specific time. It does not prove how those weights were produced. It does not prove the curriculum that led to those weights. It does not prove that the training set did not include outputs from a proprietary model.
This is not a minor limitation. It is the entire vulnerability. In the Ethereum 2.0 slasher audit, the protocol checked whether a validator had signed conflicting messages. The evidence was public because the signed messages were public. The invariant was enforceable because a slashable offense left an unforgeable record. AI training has no equivalent artifact. The teacher model’s output is not signed as evidence when it is used for distillation. The student model’s update is not broadcast to a consensus layer. There is no global mempool of gradient steps. There is no public log of loss curves. If the distillation happened in a private Chinese training cluster, the only record is whatever data and code the cluster operators chose to preserve.
That is not a problem that better cryptography can solve in isolation. A zero-knowledge proof of training would prove that a given model was trained on a given dataset with a given compute procedure. It would not prove that the dataset itself was lawfully obtained. It would not prove that items in the dataset were not generated by another model. A Merkle root over the training data is only as meaningful as the source classification attached to each leaf. If a web crawler collects millions of pages and one page contains a transcript of a GPT-4 output, the Merkle root sees only text. It does not see the terms-of-service violation embedded in that text.
Proof-of-Training Is Not Proof-of-Origin
The decentralized AI community has spent the last few years proposing proof-of-training protocols. The idea is attractive: a miner or prover commits to a model training run and publishes a sequence of checkpoints that can be verified by a challenger. The model can then be registered on-chain with a lineage that appears trustworthy.
The academic history of proof-of-learning should give us pause. Researchers demonstrated that a proof-of-learning based on periodic checkpoints can be spoofed. An attacker does not need to actually train the model in the claimed way. The attacker can construct a condensed set of checkpoints that satisfies the verification logic without containing the real training trajectory. This is not a failure of a single implementation. It is a failure of the idea that a loss curve can serve as a witness of the data that produced it. The proof is in the unverified edge cases, and the edge case is that many different datasets can lead to nearly identical loss curves.
Even if the proof-of-training mechanism were robust, it would not answer the geopolitical question. Suppose a Chinese lab publishes a complete training run with all data commits, all gradient updates, and all model checkpoints. Suppose the lab shows that its model’s loss decreased smoothly and that no private weights were loaded into its cluster. None of that proves that text outputs from a U.S. model were not used as training targets. Those outputs could have been processed into a fine-tuning set that is not included in the proof. Or they could have been memorized by a smaller intermediate model whose own logits were then used to train the final models. Distillation can be chained. The ultimate teacher can be one step removed.
This recursive problem is the real reason why the U.S.-China dispute is not merely a legal disagreement. It is an audit failure at the level of the underlying technology. We do not have a machine-readable way to express the relationship between a model and its training data that is robust against deliberate obfuscation.
ZKML Cannot Save This Narrative
Let me address the hype around zero-knowledge machine learning before it overwhelms the discussion. ZKML is a remarkable engineering achievement. It allows a prover to show that a specific model with a specific weight hash was executed on a specific input and produced a specific output, without revealing inputs or weights. For inference markets, this is genuinely useful. It can prove that a prediction came from a particular model rather than from a private oracle. It can make model-serving providers accountable to the outputs they publish.
But ZKML does not prove provenance. It proves execution. It answers the question "was this output produced by this model?" It does not answer the question "was this model produced by this training process?" The two are often confused in marketing material.
A zk-proof of inference is a statement about a single computational step. Training is a sequence of billions of computational steps, many of which involve data whose origin is not represented in the circuit. To prove that training was clean, the prover would need to make the entire data pipeline transparent, including the source of each text, the license attached to each text, and the intent of the person who collected it. Even then, the circuit would have no way to verify the semantic distinction between a human reading a blog post and a model learning from a competitor’s API response. That distinction is not a mathematical property of the text. It is a social and legal property of the context.
I have spent the last two years building verification frameworks for zero-knowledge AI inference, and I have found side-channel risks in implementations that used PLONK-style proofs. Those risks were important, but they were tractable. The distillation problem is not tractable in the same way. It is not a flaw in a circuit design. It is an absence of a shared ground-truth layer at the place where training data becomes model weights.
This is the central tension of decentralized AI: the more rigorously you try to prove training provenance, the more you rely on trusted metadata. A global registry of training data with source attestations is a trusted oracle problem. The oracle would need to classify every text as either "openly licensed" or "proprietary model output" or "unknown." That classification is contested. Washington and Beijing cannot agree on the classification, so no neutral cryptographic gadget can resolve the dispute.
Ronin Did Not Fail; It Was Engineered to Trust
This is where my bridge-autopsy background overwhelms the AI narrative. Ronin did not fail; it was engineered to trust.
The Ronin bridge hack was not an exploit of a subtle cryptographic weakness in the signature scheme. It was a breakdown of the trust assumption embedded in the validator set. The bridge was designed to rely on off-chain validators. The validators were not primarily stored in immutable code. They were operated by human institutions with keys that could be socially engineered or compromised. The protocol worked exactly as specified. The problem was that the specification trusted the wrong parties at the wrong boundary.
A closed frontier model is a similar structure. It is engineered to generate text for anyone who passes an API gate. The security boundary is the API gate, but the leak vector is the text itself. The model cannot distinguish a legitimate consumer from an unauthorized distiller because both are just agents making requests. The provider trusts that the user will respect a legal contract. That trust may be reasonable in a commercial context. It is unreasonable when the counterparties are powerful governments with competing strategic interests.
If Washington is correct that a Chinese laboratory used U.S. frontier model outputs to train a competitor, then the event was not an intrusion. It was a natural consequence of exposing a high-value generative model to an untrusted adversary. The only defense that would actually prevent distillation is to not serve the model at all. Rate limits reduce the quantity of outputs but do not eliminate the information leak. Watermarking can detect outputs after the fact but does not prevent the training signal from being used. Filtering suspicious users requires surveillance that undermines the utility of the product. Once the model’s output is public, the knowledge is public.
This is exactly why the phrase "unauthorized distillation" is so awkward. From a cryptographic standpoint, the model issued an output. It authenticated that output through the normal API channel. The recipient used that output as intended by the model’s designers: they extracted information. The unauthorized part is not in the message; it is in the use. Cryptographic systems authenticate messages. They do not authenticate the mental state of the reader.
The Geopolitics of the Gradient
The report I analyzed correctly notes that the dispute sits at the intersection of national security, economic security, and information warfare. Its radar chart gives geopolitical competition a seven out of ten and military capability a four out of ten. I would push back on one point: the low military score does not mean the issue is less dangerous. It means the report lacks data. That absence of data is itself a finding.
An AI model is not a missile. It does not need to be physically delivered to a target. Its effects are mediated by software, data, and human decision-making. A model that performs well at cyber reasoning can accelerate vulnerability discovery. A model that performs well at logistics can improve military planning. A model that can generate propaganda at scale can alter an information environment. In all of these cases, the capability is embedded in the weights. The weights themselves are only the final snapshot of a training process that may have absorbed knowledge from many sources.
The U.S. accusation treats distillation as theft of strategic capability. The Chinese denial treats the accusation as an attempt to discredit Chinese innovation. Both interpretations are consistent with the underlying evidence. A forensic investigator cannot look at a trained model and determine with certainty which sources contributed to its capabilities. This is known as the interpretability problem, and it is unsolved. Even when a model has memorized exact passages from its training data, the memorization is not easily attributable to a single API session. The path from a training sample to a final parameter is diffused through billions of updates.
Some researchers have proposed model watermarking to solve this problem. The idea is to embed a hidden signal in the generated text that can be detected later. If the text appears in another model’s training data, the watermark can be used to prove that the other model was trained on the outputs. This is clever, but it has fundamental limitations. Watermarks can be removed by paraphrasing, which is a standard post-processing step. Watermarks also degrade sample quality if not implemented with care. Most importantly, watermarking can prove that a text was used as training data, but it cannot prove who used it or why. It gives evidence, not complete provenance.
The Missing Settlement Layer
In protocol terms, the U.S.-China distillation dispute is a settlement failure. A claim has been asserted on one side and denied on the other, but there is no canonical layer where the evidence can be adjudicated. The two parties do not share a state root. They do not share a challenge period. They do not share a set of economic incentives that would reward honest disclosure and punish false claims. They share only a set of competing narratives.
Layer 2 is merely a delay in truth extraction. I say this not as a critique of rollups, but as a reminder that scaling a claim does not make it true. A fraud proof is only useful when the proving environment has an honest majority or an economically rational challenger. In the U.S.-China context, there is no such environment. Neither side can be forced to post a bond that pays out if they lie. Neither side can be slashed for false statements. The truth can be delayed indefinitely.
The technology stack that would resolve this dispute does not yet exist. It would need to include a machine-readable definition of authorized use. It would need to bind that definition to the training process. It would need to allow auditors to detect whether a model has learned from protected outputs without requiring access to the model’s private training cluster. It would need to be accepted by both parties. That is not just a cryptographic problem. It is a coordination problem.
What the Blockchain Can and Cannot Witness
Blockchain can witness certain things very well. It can witness the existence of a model weight hash at a timestamp. It can witness that a specific prover executed a specific inference circuit. It can witness the output of a dispute game if the game is built on deterministic rules. It cannot witness the intent behind a training run. It cannot witness the hidden curriculum of a dataset. It cannot witness the thought process of a researcher who decides to use a competitor’s output as a training label.
This is not an argument against putting AI provenance on-chain. It is an argument for being precise about what on-chain records mean. A weight commitment is not a certificate of cleanliness. A model registry is not a court of law. If a decentralized AI network publishes a list of registered models without also publishing the complete source history of their training data, the registry is only a marketing surface.
Consider a simple scenario. A developer in Beijing downloads an open-source model and fine-tunes it on a dataset that includes outputs from a U.S. API. The developer then commits the resulting weights to a public model registry. The registry shows the hash of the new weights. It does not show the hours of API queries that helped generate the dataset. If the developer is careful not to commit any output logs, the registry will look clean. No on-chain mechanism can detect the missing data. The proof is in the unverified edge cases, and the edge case was never recorded.
This is why I am skeptical of proposals that try to solve AI governance by simply storing model hashes on a blockchain. Storage is not proof. A distributed ledger is an excellent way to timestamp a claim, but it is a terrible way to establish the truth of that claim if the inputs are not verifiable.
The Off-Chain Witness Problem
Where would verifiable evidence of distillation be found? In the logs of the model provider. The provider would need to record every API interaction, including the client IP address, the account identity, the prompt, the output, and the downstream behavior if observable. That kind of surveillance is expensive, privacy-invasive, and geopolitically explosive. A U.S. company that logs the queries of Chinese users and shares those logs with investigators would be accused of serving as an instrument of U.S. intelligence. A Chinese state actor who knows those logs exist would route queries through multiple jurisdictions to obscure the trail.
Attribution by API logs has the same weakness as attribution by IP address in cybercrime. The attacker can use proxies. The attacker can use multiple identities. The attacker can move between providers. The one thing that makes this different from ordinary hacking is that the attacker does not need to maintain access after the data is collected. Once an output is used for training, the evidence is embedded in the model. The only way to recover that evidence is to compare the student model’s internal distributions with the teacher model’s known examples. If the student model is not public, no comparison is possible.
The Chinese denial may or may not be truthful. The more important point is that the Chinese side has no reason to publish its model internals to prove the negative. No country releases its national security AI weights to an adversary. The United States would not do it. The United Kingdom would not do it. The demand for "transparency" is, in a geopolitical context, a demand for surrender of the very asset being protected. This is not a blockchain bug; it is a national security standoff.
Complexity Is Not a Shield; It Is a Trap
The most dangerous response to this ambiguity is to add layers of complexity on top of unresolved assumptions. A protocol that requires every data sample to be accompanied by a signed provenance certificate will fail in the open internet, where most data does not have such a certificate. A protocol that punishes models for having high statistical similarity to a competitor will create false positives and adversarial noise. A protocol that makes training data private will defeat outside verification. Every proposed solution that does not start from an honest threat model will create new attack surface.
Complexity is not a shield; it is a trap. The more complex the verification stack, the more trust is placed in the components that cannot be verified. The AI models themselves are verifiable at inference time, but not at training time. The training infrastructure is verifiable only by its operator. The data sources are verifiable only by the collectors. The intent of the user is not verifiable by anyone. No cryptographic gadget can close that gap if the physical world refuses to cooperate.
This is a lesson I learned from Curve’s StableSwap invariant. In 2020, I built simulation models of its fee mechanics and found that the structure created hidden arbitrage opportunities for sophisticated actors. The math was correct. The incentives were not. Similar patterns appear throughout the crypto and AI ecosystem. When the math holds but the incentives break, the system does not fail because of a bug. It fails because the designers did not align the game theory with the reality of untrusted participants.
The same is true for the U.S.-China distillation dispute. The math of distillation is straightforward. The legal categorization is not. The political incentives are adversarial. The technical verification methods are almost entirely absent. We cannot audit our way out of this if the invariant we want to prove was never defined in machine-readable form.
The Future of Model Lineage
So what should be built? Let me outline a serious research agenda, not a token launch.
First, we need a formal model of data provenance that separates a data item’s source classification from its content. A web page should carry a claim about whether it is an original human-authored document, a synthetic artifact, or an output of a specific model. This claim does not need to be trusted; it needs to be attached to the data item so that verification can occur later. This is similar to a signed envelope in a messaging protocol. The data item can be hashed, timestamped, and attributed to a publisher. The publisher can be held accountable for false attribution.
Second, we need an inference-time protocol that can co-sign an API output with the model identity, the API policy, and a hash of the user agreement. This would allow a downstream auditor to determine whether a particular output was served under a license that permits training use. The current APIs are almost devoid of such metadata. They return text, not a license envelope. If every output included a machine-readable policy, forensic analysis would become significantly easier.
Third, we need contamination detection research that is robust across model families. We need tools that can identify whether a student model’s internal representations depend on a teacher model’s output distribution. This is not impossible, but it is far harder than the current generation of membership-inference tests. It may require access to the password-protected model. In an adversarial international context, that access will rarely be granted voluntarily.
Fourth, we need a dispute protocol that can be used in commercial contexts before it is used in state contexts. A decentralized AI network with independent model providers could require each provider to sign a binding statement about training data origins. The protocol could then slash the provider if false provenance is discovered. The discovery mechanism might be based on random audits, staked challenges, or periodic re-evaluation. This would not solve the Beijing-Washington dispute, but it would create a proof-of-concept for a permissionless verification layer.
The risk, of course, is that such a protocol is gamed. Providers who are not caught can still cheat. The probability of detection must be high enough to deter the behavior. For national security models, the stakes are so high that even a small probability of detection will not deter a determined state actor. This is why technical provenance tools are necessary but not sufficient.
The Contrarian Reading: This Is Not a Win for Open Models
The crypto and decentralized AI community will look at this dispute and conclude that closed models are fragile because they create centralized distillation targets. The natural counterargument is that open models solve the problem because they have no API gate to abuse. That counterargument is dangerously naive.
Open models can be distilled even more easily than closed models. If the weights are public, a competitor can download them, fine-tune them, and use them as a teacher for a new model without any API restrictions. The word "unauthorized" disappears from the legal analysis because the model was intentionally released for anyone to use. Open weights are a public good, but they are also a public input. They cannot be governed by the same terms of service that bind a closed API. The U.S. accusation would be moot in an open-weight world only because the concept of authorization would become meaningless, not because the underlying knowledge transfer would stop.
A decentralized AI protocol that allows anyone to request inference is also a perfect vehicle for distillation. The protocol might not know the requester’s jurisdiction. It might not require identity verification. It might not enforce terms-of-service agreements. This is a feature for censorship resistance, but it is also a vulnerability. A state actor can use a decentralized network to query a model without revealing its identity, then use those outputs to train a private surrogate. The model registry can show the queries, but it cannot show the downstream training. Decentralization makes surveillance harder and distillation easier. That is not an argument against decentralization, but it is an argument against pretending that decentralization eliminates the threat.
The same pattern appeared in DeFi with intent-based architectures. Intent-based systems were supposed to eliminate MEV by moving order flow into a solver overlay. What they actually did was move the extractable value from on-chain mempools to off-chain negotiation channels. The problem did not disappear. It changed jurisdiction. When the math holds but the incentives break, the exploit finds the level of the stack that is least protected.
If decentralized AI becomes a major source of intelligence, the United States will respond with rules about who can query, what jurisdictions are allowed, and what data can be used for downstream training. Those rules will be enforced not by cryptographic protocols but by physical infrastructure providers, cloud regulators, and financial intermediaries. The decentralized network will be ringed by choke points. The question is whether the protocol can survive those choke points without becoming centralized itself.
Layer 2 and the Delay of Truth
I have spent my career working on Layer 2 systems, so I know the temptation to argue that the truth will eventually settle on a higher layer. Optimistic rollups assume that false state transitions will eventually be challenged and corrected. ZK-rollups assume that the state transition is valid by mathematical proof. Both systems depend on a canonical root that everyone accepts.
There is no canonical root for an AI model’s training history. There is no global index of all text that has ever been produced by a proprietary model. There is no public registry of all API users and their downstream models. The dispute between Washington and Beijing is not a dispute about a state root. It is a dispute about the real world that exists before any state root is constructed. Layer 2 is merely a delay in truth extraction. If the truth is not available at Layer 1, no layer above it can manufacture it.
This is the deepest reason why the blockchain community should care about the distillation accusation. The accusation is an attempt to create a claim that needs settlement. The denial is an attempt to prevent that claim from achieving finality. Blockchain technology offers a beautiful infrastructure for settlement, but only if the parties agree on the oracle that supplies the facts. In the AI domain, that oracle does not exist.
We will see more of these disputes in the coming quarters. Models will be accused of having learned from protected outputs. Governments will demand audit trails. Companies will issue denials. The absence of a shared provenance protocol will make every dispute a political battle rather than a technical one. The market will react by treating some models as trusted and others as untrusted, not based on the math but based on the nationality of the developer. That is a fragile equilibrium. It will fragment the global AI supply chain.
The report I reviewed flagged exactly this fragmentation risk. It saw a chance that the US-China AI dispute becomes a trigger for export controls, information warfare, and parallel technical ecosystems. I would add a more specific warning for builders: do not assume that adding a proof-of-training to your model registry will make your model politically neutral. A proof is only meaningful if the definition of the offense is shared. The United States and China do not share a definition of unauthorized use. They do not share a definition of national security AI. They do not share a definition of fair competition. No technical proof can reconcile definitions that are structurally opposed.
Where the Evidence Must Live
The most mature way to think about this problem is to compare it to financial audit. In traditional finance, an auditor cannot prove that every transaction was honest. The auditor can only prove that the records are complete, that controls were in place, and that the signatures match. The auditor relies on the integrity of the record-keeping system. If a company keeps two sets of books, the audit will not catch the hidden set unless the auditor has the power to subpoena evidence from outside the company.
AI provenance faces the same challenge, with an additional difficulty: the record-keeping system is distributed across geographically and politically separate actors. The model provider has logs. The cloud provider has infrastructure logs. The training cluster operator has data loading logs. The data collection pipeline has source URLs. Each actor controls a fragment of the evidence. No single ledger connects them.
A serious solution would require all actors to write their logs to a shared, append-only, tamper-evident structure. The model provider would record a hash of every API output under a policy ID. The data collector would record the source of every training document. The trainer would record the precise order in which documents were consumed. The inference market would record the model hash associated with every output. This creates a lineage graph from data to gradient to weight to output. It is not impossible. It is just expensive, intrusive, and difficult to make interoperable.
The U.S.-China dispute could become the regulatory forcing function that makes such lineage graphs mandatory. US companies that want to export AI services to allied markets may be required to prove that their models do not contain improperly distilled intellectual property. Chinese companies that want to export models to nonaligned markets may face similar requirements. The resulting standards could either fragment the world into blocks or create a neutral provenance format that everyone adopts. The neutral format is far more likely if engineers, not politicians, lead the design.
This is where my optimism lives. The underlying cryptographic primitives are improving. Weight commitments are cheap. Zero-knowledge inference is becoming practical. Trusted execution environments can enforce that a model was executed inside an attestable boundary. The missing piece is not compute. It is the data provenance standard and the legal authorization grammar that attaches to each sample.
But I have seen too many protocols ship incomplete invariants to believe that this is an easy problem. If a protocol defines provenance as a simple hash of the training dataset, it will fail. If the protocol does not require every dataset item to carry a source claim, the dataset hash is meaningless. If the protocol permits an operator to mark an item as "unknown" without penalty, the adversary will mark all sensitive items as unknown. The invariant must be strict enough to make evasion costly and flexible enough to accommodate the messy openness of the internet.
The Risk of False Attribution
There is another danger that the public discussion has not yet absorbed. If distillation detection tools become powerful enough to convict, they will also become powerful enough to frame. An adversary with access to a student model can deliberately poison its training data with outputs from a rival model. The student model will then carry a detectable trace of the rival. A later forensic examination will find the trace and conclude that the rival was distilled without authorization. The true story is the reverse: the trace was planted.
This is analogous to a replay attack in a settlement protocol. A transaction signature is evidence only if the signing context is authentic. In a machine learning context, a contamination trace is evidence only if the contamination was accidental or was performed by the model developer. An attacker can create a false positive by intentionally feeding the rival’s outputs to a model they control. The same technology that enables attribution enables deception.
In intelligence analysis, this is called the false-flag problem. It is the reason why classified assessments must be based on multiple independent sources rather than on a single technical signal. Distillation evidence will need to be corroborated by API logs, network traffic, payment records, and human intelligence. None of those sources will be shared in a public blockchain article. This makes the dispute an intelligence question, not an engineering question, and it explains why the report I analyzed leans heavily on geopolitical scoring rather than technical evidence.
What I Would Ask the Providers
If I were consulting a frontier AI company today, I would not start by asking about their safety policies. I would ask about their inference logs. How much data do they retain? How long do they retain it? Do they have a pipeline for detecting unusual request patterns that resemble distillation? Do they analyze correlations between API queries and downstream model releases? Do they sign API outputs with a metadata envelope? Do they watermark outputs? Do they have an incident-response protocol for cross-border model provenance disputes?
The answers to those questions will determine whether the company can defend itself in a politically charged legal battle. A company that logs everything will have a surveillance problem. A company that logs nothing will have a litigation problem. The middle path is to log a minimal set of cryptographic artifacts: a hash of the prompt, a hash of the output, the policy version, and the timestamp. This gives the company the ability to prove that an output was served under a particular policy without indefinitely storing personal content. That is an audit log rather than a surveillance feed.
The same practice should apply to decentralized networks. A model provider that serves inference outputs should attach a machine-readable policy to every response. A client that wants to train on a response should be required to request a training license or disclose its intended use. This can be implemented as a protocol handshake rather than as a legal click-through. The policy can be signed by the model provider, and the client can decide whether to accept the restriction. If the client violates the policy, the signed interaction is evidence that can be used in an off-chain dispute.
Of course, this does not stop a determined government from violating policies. It does, however, establish a baseline of evidence. Without such evidence, the U.S.-China dispute will remain an exchange of unverifiable claims.
The Takeaway
The next big bridge incident may not look like a bridge incident at all. It will arrive as a model release that cannot prove its training data lineage. A claim will be made. A denial will be issued. The media will treat it as a political story. The engineers will recognize it as an accounting problem: we did not define an invariant for authorized knowledge transfer, so we cannot detect when it is violated.
I want to see a new verification invariant that is as fundamental as an asset-backed bridge invariant. For a bridge, the invariant is locked equals minted. For a model, I want the invariant to be: every training sample carries a source classification; every source classification is attributable; every attribution is checkable. If any sample in the training set lacks a source classification, the model’s lineage is incomplete and should not be certified. That is a brutal standard, but the alternative is a world where every AI release is a political target.
The technology is hard. The politics are harder. The proof is in the unverified edge cases, and the largest unverified edge case is not a line of code. It is the boundary between reading an answer and learning from it. We can build protocols that witness what a model says. We cannot yet build protocols that witness what a model silently takes from the world while saying it.
In 2026, after years of decentralized AI experiments, I remain convinced that the answer will not come from a single proof system. It will come from a discipline of recording source claims from the first byte of data to the final gradient of a deployed model. Until then, Washington may accuse, Beijing may deny, and the market may chase whichever token promises the fastest path to verified AI. But if there is no agreed oracle for what counts as authorized knowledge transfer, the dispute will not be settled by code. It will be settled by power.
If you are building an AI provenance protocol, start with the most uncomfortable question first: how will you prove the negative? How will you prove that your model did not learn from a competitor’s output? If your answer requires trusting a data collector’s summary, you have not built a proof. You have built a confidence game. The market will eventually discover which confidence is backed by an invariant and which is backed only by a signature on empty attestations.
That is the warning I would put at the top of every Layer 2 research summary this quarter. AI is not yet a settlement layer. It is an oracle feeding an oracle, and the final truth is still out of reach. Silence in the slasher was the first warning sign. The current silence, the silence of missing training logs and unshared forensic evidence, is the second. Do not wait for the third.