How do I prove data was not used to train an AI model?

Seal the training corpus into a complete, ordered, cryptographically sealed enumeration. Every record is hashed, the digests are sorted, and folded into a single Merkle root. To prove a record is absent you produce inclusion proofs for the two adjacent sealed entries that bracket where that record would sort, plus a proof they are adjacent — so the gap provably contains nothing. A signed PDF inventory cannot do this, because absence can only be shown against a complete sealed set.

What does the EU AI Act require for training data documentation?

High-risk obligations apply from August 2026 and require providers to document training data provenance, composition and processing. Most stacks answer with a document that can be edited after the fact and cannot be independently checked. A sealed attestation gives an auditor a 32-byte root, a few-kilobyte proof, and the ability to verify with standard SHA-256 rather than trusting the provider.

Can an auditor verify the attestation without vendor software?

Yes, and that is deliberate. Verification is plain SHA-256, a public standard. The tool emits a dependency-free script an auditor, regulator or data subject can run themselves, offline, with no account and no licence. A proof you must buy the vendor's software to check is not a proof.

Does the attestation prove what the model actually learned?

No, and we state that plainly. It proves the corpus you declared and sealed. A record that entered training outside the sealed pipeline is invisible to it — that is a process control, not a mathematical one. Statistical membership inference attacks the same question from the model side and is complementary, not a substitute.

Does the seal prove the declared composition is accurate?

It proves the composition claim has not been altered since sealing — not that it was true when written. What the sealed enumeration adds is that an auditor with corpus access can independently recount and falsify the claim. That moves it from self-asserted to checkable, which is a meaningful gain but a different one.

How large are the proofs for a big training corpus?

They grow logarithmically. Measured: at one million records, sealing takes 3.4 seconds, the published root is 32 bytes, an absence proof is about 3.3 KB, and verification takes 0.27 milliseconds. A thousand times more records costs roughly 1.8 times the proof size.

EU AI Act — Article 10

“Prove my data wasn’t in your training set.”

Showing a record was used is easy. Showing one was notis the question people actually ask — and a signed PDF inventory can never answer it.

Published attestation — contains no training data12 records sealed

Merkle root: sealing…
Declared composition: 8 real / 4 synthetic
Seal: INTACT — manifest bound to root

Was this record used to train the model?

Computed in your browser with WebCrypto SHA-256. Nothing is uploaded. The proof stays a few hundred bytes whether the corpus holds twelve records or a million.

Absence, not just presence

Anyone can show a record was included. Proving one was NOT requires a complete sealed enumeration — which is the whole difference between an attestation and an inventory.

The proof carries no data

What you publish is a 32-byte root and your declared composition. No training data leaves your environment, ever.

Auditors need nothing of ours

Verification is plain SHA-256. We ship a dependency-free script so a regulator can check the claim offline, without a licence or an account.

What this does not prove

It proves the corpus you declared and sealed — not what a model actually ingested. A record entering training outside the sealed pipeline is invisible to it, and no amount of cryptography changes that; it is a process control. The seal likewise proves your composition claim is unaltered, not that it was true when written — though a sealed enumeration does let an auditor independently recount and falsify it.

We would rather write that here than have it discovered in an audit.

See the tamper-evidence demo AI Evidence Vault Provable deletion

Pricing

Free

10,000 records sealed per month — enough for a real fine-tune, not a toy.

Team

$299/ month

5,000,000 records per month. Self-serve, cancel anytime in Stripe.

Compliance

$1,499/ month

100M records per month, unlimited corpus labels, DPA, and an auditor pack.

Enterprise

from $45k/ year

Unlimited volume, on-premise, named support, and audit representation.

Verification is free on every tier, forever — including Free. Sealing is what we charge for. The verifier we emit is dependency-free and runs offline, so an auditor checking your proof never contacts us and could not be billed even in principle. A proof you must buy our software to check is not a proof.

Talk to us about Compliance or Enterprise

Common questions

How do I prove data was not used to train an AI model?: Seal the training corpus into a complete, ordered, cryptographically sealed enumeration. Every record is hashed, the digests are sorted, and folded into a single Merkle root. To prove a record is absent you produce inclusion proofs for the two adjacent sealed entries that bracket where that record would sort, plus a proof they are adjacent — so the gap provably contains nothing. A signed PDF inventory cannot do this, because absence can only be shown against a complete sealed set.
What does the EU AI Act require for training data documentation?: High-risk obligations apply from August 2026 and require providers to document training data provenance, composition and processing. Most stacks answer with a document that can be edited after the fact and cannot be independently checked. A sealed attestation gives an auditor a 32-byte root, a few-kilobyte proof, and the ability to verify with standard SHA-256 rather than trusting the provider.
Can an auditor verify the attestation without vendor software?: Yes, and that is deliberate. Verification is plain SHA-256, a public standard. The tool emits a dependency-free script an auditor, regulator or data subject can run themselves, offline, with no account and no licence. A proof you must buy the vendor's software to check is not a proof.
Does the attestation prove what the model actually learned?: No, and we state that plainly. It proves the corpus you declared and sealed. A record that entered training outside the sealed pipeline is invisible to it — that is a process control, not a mathematical one. Statistical membership inference attacks the same question from the model side and is complementary, not a substitute.
Does the seal prove the declared composition is accurate?: It proves the composition claim has not been altered since sealing — not that it was true when written. What the sealed enumeration adds is that an auditor with corpus access can independently recount and falsify the claim. That moves it from self-asserted to checkable, which is a meaningful gain but a different one.
How large are the proofs for a big training corpus?: They grow logarithmically. Measured: at one million records, sealing takes 3.4 seconds, the published root is 32 bytes, an absence proof is about 3.3 KB, and verification takes 0.27 milliseconds. A thousand times more records costs roughly 1.8 times the proof size.

The demo corpus is illustrative. The hashing, sealing, and both proof directions are genuine and run entirely in your browser.