Every dataset, every transform, and every model version is traceable end to end. Given a model, you can name exactly what it was trained on and how it came to be.
Provenance is a byproduct of the pipeline running, so it is complete and contemporaneous.
Datasets, shards, checkpoints, and weights are identified by cryptographic hash. An artifact's identity is its content, so tampering or substitution changes the address.
Every cleaning, filtering, dedup, tokenization, and augmentation step is logged with its inputs, parameters, and outputs. A processed dataset points back to its raw source unbroken.
Each training run emits a manifest binding the exact corpus snapshot, code version, hyperparameters, and hardware to the resulting weights. The run is described by an artifact, not a memory.
Provenance records are signed with ML-DSA-65 and chained, so the lineage graph is tamper-evident from raw source through deployed model.
You can walk from a source to every model it touched, or from a model back to every source it saw.
Given a dataset, the graph lists every model version, fine-tune, and derivative that incorporated it — essential when a source must be recalled or a license is challenged.
Given a model version, the graph reconstructs its full input set: which corpus snapshot, which transforms, which prior checkpoint it was continued from.
Base models, continued pretraining, and fine-tunes form an explicit ancestry tree. A deployed model's full genealogy is one query, not an investigation.
Corpus, code, weights, and evaluation results share identifiers, so a claim about a model can be joined to the exact data and tests behind it.
Provenance is only credible if the recorded inputs actually reconstruct the recorded output.
Corpus snapshots and code are pinned by hash per run, so the exact inputs that produced a model remain retrievable and unambiguous.
Framework versions, kernels, and configuration are recorded with the run. Divergence between what was intended and what executed is detectable rather than assumed away.
Where the stack supports deterministic execution, a run can be replayed to the same weights; where it cannot, the sources of nondeterminism are documented in the manifest.
A deployed model's hash is checked against its signed manifest, so operators can confirm they are serving the exact artifact the lineage describes.
The record is built for the moment someone must answer for what a model is.
The full provenance of a model can be exported as a signed evidence package for regulators or external auditors, without exposing the underlying sensitive data.
If a source's legitimacy is challenged, the graph shows precisely which models are affected and to what degree, turning a vague concern into a bounded remediation.
Because records are hash-chained, the order and content of lineage events cannot be quietly rewritten. History is append-only and verifiable.
Provenance records are retained to match the jurisdiction's evidentiary and financial-record requirements, independent of the lifespan of the models themselves.