Key takeaways
Frontier models are increasingly trained and evaluated on the judgment of human experts, yet that judgment is one of the least verifiable inputs in the entire pipeline. Most labs simply trust their vendor that the right people did the work, the right way, without undisclosed shortcuts.
This is a solvable problem. A tamper-evident, per-task audit trail, trust scores for both experts and individual data batches, and inter-rater agreement computed live rather than after the fact turn data quality from a claim into something a reviewer can independently check.
- Provenance is a per-task, signed record of who did what, when, and with how much model assistance.
- Trust scores make the health of an expert and a batch visible while work is in progress.
- Live inter-rater agreement flags divergence before a batch ships, not after.
- A reproducible lineage bundle lets an external auditor replay and verify the data.
What is data provenance in AI training?
Data provenance is the documented history of a dataset: where each item came from, who produced or labeled it, under what instructions, and what was done to it before it reached a training run. For human-generated data, provenance answers the questions a careful reviewer would ask, but usually cannot: who made this judgment, what did they see, and how do I know it is real?
A model weight is reproducible; a human judgment is not. Once a rating, ranking or rationale is recorded, there is normally no trace of the person, the context or the process behind it. When the only artifact is the final label, quality control collapses into spot checks and good faith. That is fine for low-stakes labelling and unacceptable when the data shapes a model used in medicine, law, finance or security.
How to make human-labeled data verifiable
Verifiability comes from capturing the process while the work happens, not reconstructing it afterwards. If every task event, assignment, draft, edit, rationale and submission, is written to a hash-chained, signed log, the record becomes tamper-evident. Altering a single row breaks the chain, so a reviewer can confirm that what they are looking at is what actually happened.
On top of that record, compute trust scores for each expert and each data batch and surface them live. A batch stops being a black box that passes or fails at the end; its health is visible as it is produced. Overlapping a fraction of assignments across multiple experts lets you measure agreement in flight and flag divergence as it appears.
- Sign and hash-chain every task event so the trail is tamper-evident.
- Record model assistance explicitly: what the AI drafted vs. what the human decided.
- Score experts and batches continuously, not just at delivery.
- Overlap assignments to compute live inter-rater agreement.
- Export a per-batch lineage bundle that an outsider can replay.
What to ask a data vendor about provenance
If you buy human data, the fastest way to gauge a vendor's seriousness is to ask how they would prove a delivered batch to a hostile auditor. Vague answers about quality processes are a red flag; concrete answers about per-task records are not.
Use these questions as a starting point in vendor due diligence.
- Can you produce a per-task audit trail for any item in this batch?
- Is that trail tamper-evident, and how would I detect a changed record?
- How do you record and disclose AI assistance on each task?
- Do you measure inter-rater agreement live, and what happens when it drops?
- Can you export a provenance bundle that maps to AI-Act Annex IV fields?
Withstanding adversarial review
The real test of any provenance system is whether it survives someone trying to break it. A reproducible lineage bundle, who did what, when, with which model assistance, at what level of agreement, signed end to end, should withstand a hostile reviewer, not just a friendly one.
That is the bar worth holding yourself to, because it is increasingly the bar that regulated buyers will be held to as well. Provenance is not a certificate you show once; it is a trail any auditor can replay against the delivered data.