AI provenance — tier glossary

Vector dimensionality and dtype declared by the upstream embedding provider matches the tensor consumed downstream — no silent truncation, no float64↔float32 cast, no projection-head mismatch between fine-tune base and adapter.

Numeric, string, and categorical dtypes propagate consistently through every pipeline stage. A column declared int32 in the dataset card is not silently widened or stringified before reaching the trainer.

The MLCommons Croissant 1.1 manifest declared for a dataset matches the actual record set on disk: every field, distribution record, and record-set reference resolves and typechecks against the manifest schema.

The HuggingFace dataset-card YAML front-matter (license, language, task_categories, size_categories, source_datasets) is well-formed and the declared license is recognised by the corpus crawler.

The training corpus does not contain near-duplicate rows that would inflate sample-count and bias the loss surface. Cross-corpus deduplication is materialised as a tag, not a footnote.

Per-source row counts reported in the dataset card and Annex IV §2(d) match the shard-by-shard tally produced by the training pipeline at compile time. No silent overrun, no row-multiplier from a fan-out join.

Rows derived from EU data subjects (under GDPR Art. 4(1)) carry an `eu-personal-data` taint that must propagate through every transform. A row tagged `eu-personal-data=true` cannot reach a sink declared `eu-personal-data=false` without an explicit, lawful-basis-tagged anonymisation step.

Text excerpts whose source is under a copyright licence the corpus does not hold (or where the upstream TDM reservation under DSM Art. 4(3) was set) carry a `copyrighted-text` taint. Forbidden-flow refutation: no `copyrighted-text=true` row reaches a generative-output sink.

Rows belonging to a subject who has exercised GDPR Art. 17 erasure are tagged `gdpr-erased=true`. Forward-flow check: no erased row appears in a downstream training corpus, embedding store, or model checkpoint produced after the deletion timestamp.

Rows certified under Creative Commons CC0 (or another permissive declared licence) carry an explicit licence tag that survives every join. Used as the positive case in tag-flow proofs — the `license=CC0` set is the safe-harbour subset of the corpus.

Rows produced by a generative model carry a `synthetic=true` tag plus a generator-lineage manifest reference. Required to satisfy AI Act Art. 50 transparency and to prevent silent model-output-as-training-input loops.

Outputs sampled from a deployed model. Tagging this class of row is the only way to make the model-output→training-input feedback loop visible to the verifier.

The negative-space tag: every row that crossed the boundary from raw corpus to a training shard. Combined with `eu-personal-data`, `copyrighted-text`, `gdpr-erased`, etc. to form forbidden-flow predicates of the form `tag=X ⇒ training-input=false`.

Rows that passed an internal red-team review and have a signed reviewer attestation in the audit ledger. Used as a positive gate on jailbreak / safety-evaluation corpora.

After a Data Subject Access Request erasure runs against the source warehouse, the verifier proves no path remains from the deleted row to any pinned model artefact (embedding, checkpoint, fine-tune, KV-cache). This is the P7 erasure-completeness primitive.

Specialised case of dsar-residual: weights produced by LoRA / full fine-tuning are themselves a downstream artefact of the source rows. Erasure-completeness must reach into adapter weights, not just the corpus shard.

The vector store (FAISS, pgvector, Pinecone) holds embeddings derived from rows that should no longer be reachable from production sinks. The reverse-direction tag-flow proof must close over the embedding index, not just the source table.

Per-column / per-record provenance string (vendor + dataset version + acquisition date + due-diligence record ID) survives every transform. The closure of source-attribution sets at any sink IS the Annex IV §2(d) summary.

When two rows are joined, the resulting row inherits the meet of their licences in the licence lattice. CC-BY ⨝ proprietary = proprietary; CC-BY-SA ⨝ MIT = CC-BY-SA. The verifier rejects any sink where the inherited licence is incompatible with the declared use.

Every model-card field (training data, evaluation metrics, intended use, known limitations) is backed by a compile-time fact pinned to a git SHA + dbt manifest hash. The model card is signed; tampering refutes the signature.

Each Annex IV §1–§9 section in the published technical-doc pack is a hash-pinned reference into the audit ledger. A regulator can replay any cited fact against the original Croissant manifest + pipeline IR snapshot.