What Is a Tamper-Evident Audit Trail for AI Inference?
A tamper-evident audit trail for AI inference is a cryptographically chained record in which every entry incorporates the one before it, so any alteration to a past entry breaks the chain and becomes detectable. Each inference call an LLM makes is anchored to this chain, and each entry is signed with post-quantum cryptography (ML-DSA). Unlike a mutable log that can be silently edited, this record cannot be quietly rewritten — and an auditor can verify its integrity independently on your own hardware.
The point isn't that changes are impossible. The point is that they're detectable. That single property is the difference between a record a regulator will accept and a log that is, in evidentiary terms, worthless.
How the chain works
A tamper-evident audit trail borrows the core idea behind a blockchain without the ceremony: each new entry contains a cryptographic hash of the entry before it. That hash is a fixed-length fingerprint of the previous record's exact contents. Change one byte of a past entry and its fingerprint changes, which means the fingerprint stored in the next entry no longer matches — and so on down the line. The break propagates.
- An inference call happens. The request, the response, who asked, and when are captured as a record.
- The record is hashed and linked. The new entry embeds the hash of the previous entry, binding it to everything that came before.
- The entry is signed. A post-quantum ML-DSA signature is applied, so the entry's authenticity and integrity are provable, not just asserted.
- Anyone can re-verify. Recompute the hashes and check the signatures. If the chain is intact, the history is intact. If any past entry was touched, the verification fails at exactly that point.
Every inference call is anchored to the chain
In a Hyfstele deployment, the audit chain is not an optional side-channel that logs "some" activity. Every inference call the model serves is anchored to it. That means the record of what the model was asked and what it returned is complete by construction: there is no path for a call to be served without a corresponding, signed, chained entry. Completeness is not a policy you hope holds — it's a property of how the system is wired.
The role of post-quantum signing (ML-DSA)
Hashing links the entries; signing is what makes an alteration provable rather than merely suspected. Each entry carries a digital signature, and Hyfstele uses ML-DSA — the NIST-standardized post-quantum signature scheme — so the guarantee survives the eventual arrival of cryptographically relevant quantum computers.
This matters specifically because of retention. A pharmaceutical or federal record may need to remain verifiable for years or decades. Signing today's inference records with a post-quantum algorithm means the integrity claim you make in 2026 is still a claim you can defend when the record is pulled in an inspection long after. You are not betting the audit trail on cryptography that a future adversary can forge.
Tamper-evident vs. a mutable log
| Property | Ordinary application log | Tamper-evident audit trail |
|---|---|---|
| Editing a past entry | Possible and invisible | Possible, but breaks the chain and is detectable |
| Deleting or backdating | Leaves no trace | Invalidates every entry after it |
| Basis of trust | "Trust our access controls" | Recompute the hashes and check the signatures yourself |
| Who can verify | Effectively only the vendor | An auditor, independently, on customer hardware |
| Survives quantum threat | N/A — usually unsigned | Signed with post-quantum ML-DSA |
A mutable log can answer "what does the record say now?" It cannot answer "has the record been changed since it was written?" — and for a regulated audit trail, the second question is the only one that counts.
The diligence value: verify it yourself
Because the trail is deployed inside your own perimeter and the verification is purely cryptographic, an auditor doesn't have to take anyone's word for it. They can recompute the chain and check every signature independently, on the customer's own hardware. The integrity guarantee rests on evidence they can reproduce, not on a vendor attestation they have to trust.
That's the posture Hyfstele takes across the board. The tamper-evident audit chain is the fourth of four independently verifiable controls in a Hyfstele deployment — a secure-LLM setup that runs open-weight models inside your own air-gapped perimeter:
We do not claim the model is clean, safe, or free of hidden behavior — no one can honestly claim that about an open-weight model. What we do is make four controls verifiable on your own hardware. The audit trail is one of them: it doesn't prove the model is trustworthy, it proves that the record of what the model did is complete and unaltered. Evidence, not our word.
Why Part 11 and GxP require exactly this
21 CFR Part 11 and the broader GxP expectations for electronic records demand that records be complete, attributable, and protected from undetected alteration for their full retention period. Read against a tamper-evident chain, those requirements map almost one-to-one:
- Complete — every inference call is anchored to the chain by construction, so no activity is silently missing.
- Attributable — each entry ties a specific request and response to who asked and when.
- Unalterable in practice — Part 11 doesn't require that records be physically impossible to change; it requires that any change be detectable. A signed, chained trail delivers exactly that.
This is why an AI system aimed at regulated work — like Hyfstele's assist for pharmaceutical MLR (Medical, Legal, Regulatory) promotional review — treats the audit trail as load-bearing infrastructure, not a logging afterthought. The MLR assist follows a strict doctrine: It flags. You decide. The flow is Flag → Judge → Prove, with no LLM inside the flag-decision plane. The tamper-evident trail is the "Prove" — the durable, verifiable record of what was flagged, what a human decided, and the inference behind it.
Frequently asked questions
What is a tamper-evident audit trail for AI inference?
It is a chained record in which each entry cryptographically incorporates the one before it, so any alteration to a past entry breaks the chain and becomes detectable. Every inference call an LLM makes is anchored to this chain, and each entry is signed with post-quantum cryptography (ML-DSA). Unlike a mutable log that can be silently edited, a tamper-evident trail cannot be quietly rewritten without leaving a detectable break.
How is tamper-evident different from a normal log?
A normal application log is mutable: rows can be deleted, edited, or backdated and nothing in the record reveals it happened. A tamper-evident audit trail links each entry to a hash of the previous entry and signs it, so editing or removing any past record invalidates every entry after it. Tamper-evident does not prevent someone from trying to change the record; it guarantees the attempt is detectable.
Why sign the audit chain with post-quantum cryptography (ML-DSA)?
The signatures are what make an alteration provable rather than merely suspected. ML-DSA is a NIST-standardized post-quantum signature scheme, chosen so the integrity guarantee survives the arrival of quantum computers. Regulated records must remain verifiable for years or decades, so signing with a post-quantum algorithm keeps the trail defensible over the record's full retention lifetime.
Can an auditor verify the chain without trusting the vendor?
Yes. Because the trail is deployed inside the customer's own perimeter and the verification is cryptographic, an auditor can recompute the chain and check each signature independently on customer hardware. The diligence value is that the guarantee rests on evidence they can reproduce, not on the vendor's assurance.
How does this relate to 21 CFR Part 11 and GxP audit-trail requirements?
Part 11 and GxP require electronic records to be complete, attributable, and protected from undetected alteration for the retention period. A tamper-evident, signed chain makes each inference call attributable to a specific request and time, and makes any later change to the record detectable — which is exactly the property those regulations demand of an audit trail.
See the audit trail in a real review
The MLR promotional-review assist runs the full Flag → Judge → Prove flow, with every inference anchored to a signed, tamper-evident chain. Watch it live or ask how the four controls verify on your hardware.