AIREP: A Protocol for Per-Decision Evidence in AI Runtime Governance

As AI systems move from research prototypes to production services, operators need a way to prove that each decision the system makes—whether to release, block, defer, redact, or escalate an output—was made according to a documented policy and can be verified later without trusting the runtime that produced it. The AIREP protocol, introduced in arXiv:2608.21363v1, offers a lightweight method for creating per‑decision evidence that is self‑contained, tamper‑evident, and independently checkable.

What You Need to Know

AIREP defines a single signed object, called a record, that is generated every time an AI runtime makes a governance decision. The record contains:

• One verb from a closed set: release, block, defer, redact, or escalate.
• A reference to the governing policy that justified the verb.
• Cryptographic hashes (SHA‑256) of the input that triggered the decision, the output that was acted upon, and any supporting evidence (e.g., model scores, sensor data).
• Explicit statements of what the evidence covers and what it does not, preventing scope creep.
• A signature from the runtime’s attestation key, allowing any verifier to confirm authenticity offline.

Records are linked together in a SHA‑256 hash chain: each record includes the hash of the previous record, forming an immutable sequence. If an attacker tries to alter, remove, or insert a record, the chain breaks and the discrepancy is detectable by recomputing the hashes.

Why It Matters

Current AI governance tools often rely on logs that are tightly coupled to the runtime environment, making them vulnerable to tampering or loss when the service is upgraded or migrated. Because AIREP records are self‑describing and reference data only by hash, they can be stored in any immutable ledger—such as a blockchain, a write‑once object store, or even a simple file system—without needing the original runtime to remain online. This decoupling supports audit trails that survive system changes, satisfy regulatory requirements for explainability, and enable third‑party verification.

Furthermore, by limiting the verb set and requiring explicit evidence scoping, AIREP reduces ambiguity in governance decisions. Auditors can quickly see whether a model output was blocked because of a policy violation, deferred for further review, or escalated to a human, and they can verify that the cited evidence actually pertains to that decision. This clarity helps organizations demonstrate compliance with standards such as the EU AI Act or NIST’s AI Risk Management Framework.

Key Details

• Each record is a JSON‑like structure signed with the runtime’s private key; verification uses the corresponding public key.
• Input, output, and evidence are referenced only by their SHA‑256 digest, keeping the record size constant regardless of data volume.
• The hash chain uses the previous record’s hash as a field in the current record; genesis record starts with a fixed constant.
• Optional vendor‑, model‑, or domain‑specific metadata is confined to a single named extension block, preserving the core protocol’s simplicity.
• Because the protocol does not depend on a specific transport mechanism, records can be emitted via HTTP, message queues, or batch file writes.

What’s Next

The authors suggest integrating AIREP into existing model serving frameworks as a middleware layer that intercepts runtime decisions, creates the record, and forwards it to a chosen storage backend. Future work could explore batch verification techniques to reduce verification overhead in high‑throughput scenarios, as well as extensions for privacy‑preserving proofs (e.g., zero‑knowledge summaries) when the underlying evidence must remain confidential.

📌 Source: Arxiv Ai