A language model's output carries no detectable record of the internal computation that produced it. A new paper by Benjamin Belay, published August 17, 2026, introduces the term "computational provenance" and demonstrates that outputs can carry such evidence if the model is engineered that way from training.
The distinction matters for high-stakes deployments. Watermarking schemes like Google's SynthID-Text, PVMark, and VOW address a different question: whether an output was generated by a specific model. Belay's target is harder — can an output prove which internal reasoning path was used, not merely which model generated it? In healthcare, finance, or legal contexts, an auditor cannot verify whether the computation that produced an answer was the intended one, was skipped, or was corrupted mid-path.
The experimental setup is minimal. Two architectures—a modular feed-forward network and a transformer—were trained on arithmetic tasks with a mandatory pathway through two discrete intermediate states. Because the two states produce identical final answers, external comparison cannot distinguish which path the model took. The researchers authenticate the state used, then train the model so the verified state embeds a subtle statistical pattern in the generated text. A downstream detector recovers that pattern without access to model weights or activations.
Both architectures passed all 128 matched pairs in public evaluations, and the same result held in sealed, protected end-to-end evaluations. The required causal computation reproduced across five independently trained feed-forward models and three independently trained transformers. Zero failures across all configurations.
| Architecture | Independently Trained Models | Matched Test Pairs | Failures | Evaluation Type |
|---|---|---|---|---|
| Modular Feed-Forward Network | 5 | 128 | 0 | Public + sealed end-to-end |
| Transformer | 3 | 128 | 0 | Public + sealed end-to-end |
The critical limitation is what prevents immediate deployment. In a separate experiment using a standard transformer trained without mandatory discrete intermediate states, linear probes failed to recover a naturally learned intermediate state from the outputs. Naturally emergent internal representations do not self-annotate in generated text—the provenance signal must be engineered during training. No retrofit path to existing models is demonstrated here.
This differs from what current watermarking systems solve. VOW (April 2026) reformulates watermark detection as secure two-party computation using Verifiable Oblivious Pseudorandom Functions, solving the trust gap between user and provider. PVMark uses zero-knowledge proofs so third parties can verify detection outcomes without the secret key. University of Washington unforgeable watermarks introduce robust digital signatures to prevent false attribution. All address output attribution—who made this text. Computational provenance addresses reasoning verification—which computation produced this text. They are orthogonal problems the AI compliance conversation regularly conflates.
| System | Published | Core Method | Question Answered | Scope |
|---|---|---|---|---|
| VOW | April 2026 | Secure two-party computation (Verifiable Oblivious PRF) | Was this output generated by a specific model? | Output attribution |
| PVMark | — | Zero-knowledge proofs | Can a third party verify detection without the secret key? | Output attribution |
| UW Unforgeable Watermarks | — | Robust digital signatures | Can false attribution be prevented? | Output attribution |
| Computational Provenance (Belay) | Aug 2026 | Discrete intermediate states + statistical pattern embedding | Which internal reasoning path produced this output? | Reasoning verification |
For architects building toward EU AI Act Article 50 compliance or internal audit requirements, the practical ceiling of existing watermarking is visible: schemes relying on logit-bias at inference time can be removed by paraphrasing, disabled trivially on open-weight models, and require hours to extract payload for multi-bit embeddings. Computational provenance does not fix those problems. It operates at a different layer—model training architecture—with different requirements: discrete intermediate states, verified at training time, with the statistical pattern embedded in the generation process itself.
Arithmetic tasks with forced binary bottlenecks are not transformer inference at scale. Continuous, distributed activations across thousands of attention heads do not cleanly map to "two discrete intermediate states." Extending the approach to realistic task complexity—chain-of-thought reasoning, multi-hop retrieval, tool-calling—while maintaining causal integrity is undemonstrated. Training cost delta is also unreported.
If your audit requirement is "prove the model used the approved reasoning chain," no current production system answers that question. Belay's paper is the first controlled demonstration that the question is answerable at all.