Provenance Before Trust: Research Integrity Infrastructure

One Infrastructure Failure, Five Crises: The Case for Provenance Before Trust in Scholarly Communication

By DecentraSec Team

The peer-review bottleneck, AI-reviewer exploitation, industrial paper mills, data-sovereignty mandates, and the replication crisis do not constitute five separate problems demanding five new committees. They are five symptoms of one missing Integrity Infrastructure layer: verifiable identity, tamper-evident provenance, and durable, policy-governed storage for the scholarly record. Institutions that purchase point solutions merely relocate the vulnerability. Institutions that invest in provenance infrastructure define the standard; everyone else complies with it.

In June 2026, a research group demonstrated that adversarial repackaging—not a hidden prompt, not white text—lifted scores from three mainstream AI reviewers by +1.21 points out of 10 in 75.1 percent of trials (arXiv:2606.13044). The previous July, Nature and Nikkei Asia had exposed 18 arXiv preprints carrying covert prompt-injection instructions. When an editorial system cannot distinguish what the machine processed from what a human read, the object of peer review dissolves.

Five Crises, One Root Cause

Each of the five crises already possesses its own committee, policy document, and software patch. All five persist. That simultaneity is the diagnostic clue.

Output climbs while the qualified reviewer pool does not grow in proportion: Prophy’s analysis of 179 million papers shows submissions outrunning the senior positions that supply reviewers, and Wiley reported an 18 percent research-submission increase in Q1 FY2025. Review tasks migrate to machines whose judgment at that scale is unproven, and escalation follows: Nature and Nikkei Asia reported in July 2025 that 18 preprints carried hidden prompt-injection instructions, and the successor attack class (arXiv:2606.13044) dispenses with hidden text entirely. Paper-mill output doubles roughly every 18 months; citation cartels fabricate author identities (C&EN, February 2026); nearly 3,000 datasets vanished from data.gov after January 2025; and an audit of 640 software-engineering papers (arXiv:2512.00651) documents systemic reproducibility failure.

These are not separate scandals. Each originates in one root cause: no portable record of who claimed what, when, and with what integrity. Name that root cause and you control the shape of the solution; everyone else buys patches for symptoms.

Why “Trust by Assertion” Is the Attack Surface

Centralized archives validate by assertion: an operator states that a record is true and retains the power to rewrite it. Every “integrity portal,” “reviewer registry,” and “cloud archive” built on that model inherits five attack surfaces. Reviewer identity stays siloed and self-asserted. Manuscripts constitute adversarial inputs: a file can carry white-text instructions that no human ever sees. Authorship and timestamps remain editable, so priority claims cannot survive challenge from a mill. Data sits under a single hyperscaler’s jurisdiction, making sovereignty whatever the contract says this quarter. “The data disappeared” persists as an accepted excuse because no lineage converts disappearance into a prevented failure.

The hidden-prompt preprints, the adversarial-repackaging attack, and the reproducibility audit all exploit that same model. No review can establish a manuscript’s integrity while the file remains mutable. A tamper-evident snapshot binds the exact bytes submitted; hidden-instruction detection then tests those bound bytes. Together they establish what the machine evaluated, not what a human later recalls reading—and they do not claim to establish semantic validity. Patching a centralized database changes nothing about the underlying trust relationship; it only relocates the single point of failure.

Provenance Before Trust: The Research Integrity Infrastructure

Decentralized Provenance replaces assertion with Mathematical Validation. Concretely, the system hashes the canonical manuscript bytes plus metadata and commits that digest to an append-only log replicated across independent nodes. Each entry is signed by an authorized writer and witnessed by the other nodes. Each subsequent event—submission, review assignment, revision, publication, retraction—is an entry whose hash includes the previous entry. Verification is local: an auditor obtains an inclusion proof against a Merkle root published by multiple witnesses, then re-derives the digest chain without asking a vendor API for the truth.

This is a concrete hash-commitment and transparency-log construction, not an abstract trust slogan. It yields three verifiable properties: any change to a bound artifact changes its digest; any deletion or reordering breaks the consistency proof; and signatures bind claims to keys, while identity credentials bind keys to vetted real-world actors. Mathematical Validation is precisely the ability to demonstrate those properties from the record itself.

The honest boundary matters: a hash proves that a key made an unchanged claim, not that the person behind the key was honest. The architecture deliberately moves the trust boundary to identity enrollment and credential issuance, then makes everything after enrollment auditable. That is algorithmic integrity, not policy language.

Map Each Crisis to Its Fix

• The reviewer shortage becomes tractable as an identity problem: a shared layer of issuer-signed reviewer credentials bound to keys under the reviewer’s control lets journals widen the pool without lowering the bar, because competence and conflict history travel as checkable proofs rather than self-assertions.
• AI-reviewer attacks lose deniability at submission: the system binds the exact bytes supplied to the model, runs hidden-instruction detection against those bytes, and records the bound artifact against the score. That makes the input tamper-evident and independently inspectable; it does not make the model’s judgment trustworthy by itself.
• Data sovereignty becomes a technical property: encrypted-at-rest, geo-pinned, federated archival with independent custody attestations answers to institutional policy, not a hyperscaler’s terms of service.
• Paper mills and citation cartels lose their core advantage—post-hoc fabricated authorship, timestamps, and priority claims—because any retroactive edit or backdated insertion produces a consistency failure. The remaining attack surface is enrollment fraud, which is far smaller and auditable.
• Replication and preservation stop being someone else’s emergency when lineage is append-only and persistence is engineered: “the data disappeared” becomes a designed-against event, not a post-hoc excuse.

What This Costs—and Saves—the Modern Research Institution

The downside is concentrated and asymmetric. One gamed AI review, one retracted flagship paper, or one contested priority claim surfaces in rankings, funding reviews, and retraction databases. For Tier-1 researchers, verifiable authorship and timestamps mean discovery claims survive challenge; when claims rest on assertion alone, the loudest dispute wins.

The compliance runway is shortening as sovereignty moves from working groups into procurement criteria. Demand four properties from any partner: proofs verifiable without trusting the vendor; geo-auditable, policy-governed storage; portable credentials that travel across journals; and an append-only, tamper-evident record. Point solutions reproduce trust-by-assertion inside a new vendor. Infrastructure changes the trust model itself; that distinction constitutes the entire purchase decision.

The Window Between Best Practice and Mandate Is Closing

Prompt injection no longer constitutes an arXiv curiosity. Research Integrity and Peer Review formalized it as a research-integrity concern (DOI 10.1186/s41073-025-00187-7); Nature has covered the class twice, most recently in its August 2025 analysis of the peer-review crisis (DOI 10.1038/d41586-025-02457-2); and integrity at scale was a central theme at the 10th Peer Review Congress (Chicago, September 2025). What operates informally today becomes regulation tomorrow. Institutions that pilot durable, geo-auditable archival now become the reference standard when persistence mandates arrive; those that wait will explain their next dataset loss. First movers write the playbook; laggards comply with it. For ORIC directors, every month of delay accrues compliance debt against a sovereignty regime whose requirements remain unwritten and whose drafting credible early deployments can still shape.

Pilot Before the Mandate

This is not a software purchase; it is an infrastructure decision, in the same category as research computing, data centers, and laboratory safety. DecentraSec will co-fund and co-execute a bounded pilot with your ORIC office or research deanery: reviewer credentials, tamper-evident submission snapshots, and geo-auditable archival, measured against reviewer onboarding time, verified-submission throughput, manipulative-input detection, and audit-readiness. The first institutions to deploy in their region earn a formal seat to co-author the interoperability norms that funders will adopt. The five crises will not wait for a sixth committee. The question remains whether your institution writes the standard or complies with it.

---

References

• Prophy, analysis of 179 million papers (2025); Nature, “The peer-review crisis” (Aug 2025), DOI 10.1038/d41586-025-02457-2.
• arXiv:2606.13044, “No Hidden Prompts Needed! You Can Game AI Peer Reviewers with Adversarial Repackaging” (2026); Nature/Nikkei Asia investigation of prompt-injection preprints (Jul 2025); C&EN citation-cartel report (Feb 2026); NYT paper-mill coverage (2025).
• Mashable/404 Media, data.gov dataset removals (2025); arXiv:2512.00651 (2025).
• Research Integrity and Peer Review, DOI 10.1186/s41073-025-00187-7.