Verifiable Research Integrity: Provenance & Data Custody

Verifiable Research Integrity: Provenance and Data Custody as Institutional Infrastructure

By DecentraSec Team

The scholarly record now functions as a supply-chain dependency for the pharmaceutical, materials, AI, and policy sectors — and its incoming inspection has failed. Institutions that cannot prove custody of their data will lose the standing to earn trust with it. Compliance documentation asserts integrity. Decentralized Provenance proves it — a lineage an external party can recompute without trusting the institution that produced it. That distinction is about to sort research institutions into two classes.

In April 2026 congressional testimony, Retraction Watch put the overall scholarly retraction rate at 0.2%. By the end of 2025, its Crossref-integrated database had logged more than 63,000 retractions, compounding at roughly 22% annually since 2000. Those two figures are not contradictory: one is a small ratio over an enormous corpus, the other is the growth rate of a lagging indicator. Neither measures the true contamination rate.

A 2026 BMJ study trained a text classifier on retracted paper-mill articles and used it to screen 2.6 million cancer papers; it flagged 9.87% — roughly 260,000 — as bearing paper-mill-like textual features. Flagged means prioritised for audit, not proven fraud. Freedman and colleagues estimated in PLOS Biology (DOI: 10.1371/journal.pbio.1002165) that more than half of U.S. preclinical research is irreproducible, at a cost near US$28 billion a year.

So here is the question a dean should answer before lunch today: Show me where our data lives, who touched it, and what role a model played in producing it. Most institutions cannot. Not through carelessness — because no one ever gave them the infrastructure to prove it.

The Failure Is Measurable, Not Moral

Retraction counts are a lagging indicator. When detection improves, the number rises, not falls — which is why the 0.2% figure is best read as a floor, not a census. Paper mills now operate at industrial scale, and the literature carrying their signatures is the literature that informs trials.

Peer review, the last quality gate, is stalling. Silverchair's 2026 Future of Peer Review Report records that editors needed 4.5 invitations per completed review in 2025, double the 2018 rate. Shen and Wang (arXiv:2602.00319) find minimal AI content before 2022, then a rise through 2025, with roughly 20% of ICLR reviews and 12% of Nature Communications reviews classified as AI-generated in 2025.

Together these describe a supply chain with failing incoming inspection and no chain of custody.

From Asserted Trust to Mathematical Validation

Centralised systems demonstrate integrity through database controls and administrator trust — an assertion, not an independently checkable proof. A relational log or PDF audit trail can be edited by whoever holds the database; the auditor cannot tell a true record from a corrected one.

The requirement is therefore engineering-grade: a Mathematical Validation layer that links raw data, code, review events, and publication outputs into a tamper-evident lineage. Each artifact is content-addressed; each transition is hash-linked to the prior state and to the actor, policy, and instrument that produced it. It does not claim the science is correct; it proves lineage and integrity: a verifier can recompute the chain and detect any change made after the state was anchored. The guarantee is narrow and standard: an undetected rewrite would require breaking collision-resistant hashing.

The gap between auditable and logged is the whole argument. A database log records that something was written; a hash-linked lineage makes any later rewrite evident to anyone holding an independent anchor. That is why the infrastructure must be distributed: no single administrator, institution, or vendor may hold the only copy of the record. For ORIC directors, that is not a compliance cost; it is the asset that makes an industry partner willing to transact on academic output at all. A hash-linked provenance layer is what converts that asset into something a partner, funder, or regulator can inspect at arm's length — and recheck years later without the institution vouching for itself.

The question is no longer whether your institution asserts integrity. It is whether a third party can verify it without asking you.

Publish With Custody: The Sovereignty Turn

On 17 December 2025, the European Commission's EOSC Steering Board published its opinion paper on data sovereignty, arguing that sovereignty enables openness rather than isolation — under verifiable governance. The same day, SciELO warned that open data do not guarantee equity while processing capacity stays concentrated. Germany's DFG funds data-resilience measures for endangered repositories; Finland's Digital Independence initiative landed in February 2026; Pakistan's HEC amended its Journals and Publications Policy effective 5 November 2025.

Four policy actors — the EU, Germany, Finland, and Pakistan — converge on one requirement: enforceable evidence of where data lives, who touched it, and what role AI played. The binary of publish everything versus publish nothing is false. The real choice is publish with custody versus publish and hope.

SciELO is right that governance can be captured. That argues for verifiable custody, not against it. Sovereignty is shifting from a legal posture into an engineering property — and institutions that treat it as a document will fail the first audit that matters.

The Reviewer Shortage Is a Targeting Problem

Silverchair's diagnosis is precise: the shortage is a targeting problem as much as a motivation problem. Reviewers are not unwilling; journals match them badly. Fichtl et al. (arXiv:2608.03581) show current LLM reviews are fluent and detailed but weak in evidence grounding and overly positive — aggregate scores overstate usefulness. Paul et al. (arXiv:2508.11678) survey reviewer-assignment strategies in peer grading; competency-based and bidding mechanisms improve fairness and timeliness, while random assignment produces inconsistent grading. That is pedagogical evidence, but the design constraint transfers: assignment matters before motivation does.

The structural flaw: institutions capture reviewer effort as goodwill. It does not travel. A reviewer's reputation stays trapped inside a single journal's database — uncounted, unportable, uncompensated — while a dean absorbs the downstream cost in stretched time-to-decision, delayed commercialisation, and delayed grant resubmission.

Reviewers are not scarce. Verifiable, portable, workload-aware reviewer identity is scarce. That identity must be more than a profile: a signed, tamper-evident record of expertise, workload, and completed reviews that can move across venues without a central registry. Other regulated sectors have built portable credentials; science has not.

Proving What the Model Did

Detection is a statistical inference problem, not an evidence problem. Shen and Wang (arXiv:2602.00319) document the rise of AI text, but a detection rate is not an attribution record. Yu et al. (arXiv:2502.19614) benchmark 18 detectors against 788,984 AI-written peer reviews and find they cannot reliably identify AI-generated text at the level of an individual review.

Stop detecting after the fact. Start producing a policy-aware disclosure and audit trail at the point of work. The trail must record model identity and version, permitted-use boundary, human review decision, and resulting artifact, then hash-link that record into the same lineage as data, code, and publication. Policy-aware is the operative phrase: acceptable use in a clinical-trial manuscript differs from acceptable use in a theoretical physics preprint. A single global threshold is not governance; it is the absence of one.

Detection asks whether a machine wrote it. Attestation answers what regulators actually ask: what did the machine do, under whose policy, and can you show me? A policy-aware AI attestation layer is what turns that answer into evidence rather than assurance. That is Algorithmic Integrity in its only useful form — an artefact that answers the EOSC's demand for verifiable governance and the DFG's resilience expectations with a record, not a memorandum.

The Institutions That Will Hold

The organisations best positioned for the next decade of science will not be those that publish most openly. They will be those that can prove custody, provenance, and integrity at any moment, to any funder, regulator, or industry partner who asks.

That capability is not a policy. It is infrastructure. And institutions procure, pilot, and validate infrastructure — they do not subscribe to it.

ScholarMark by DecentraSec is building the pre-submission infrastructure that academic publishing has never had — AI-powered integrity checks, paid peer review via the GEAR Network, and immutable provenance-based authorship seals. Start here →

References

• Freedman LP et al., PLOS Biology (2015). DOI: 10.1371/journal.pbio.1002165 — verified

• Shen & Wang, "Detecting AI-Generated Content in Academic Peer Reviews," arXiv:2602.00319. DOI: 10.48550/arXiv.2602.00319 — verified

• Yu et al., "Is Your Paper Being Reviewed by an LLM? Benchmarking AI Text Detection in Peer Review," arXiv:2502.19614. DOI: 10.48550/arXiv.2502.19614 — verified

• Fichtl et al., "AI-Assisted Peer Review Across Research Communities: From Reviewer AI Policies to LLM Review Quality," arXiv:2608.03581. DOI: 10.48550/arXiv.2608.03581 — verified

• Paul et al., "Optimizing Peer Grading: A Systematic Literature Review of Reviewer Assignment Strategies and Quantity of Reviewers," arXiv:2508.11678. DOI: 10.48550/arXiv.2508.11678 — verified; pedagogical scope stated

• Retraction Watch × Crossref database; U.S. congressional testimony, 15 April 2026 — verified

• BMJ machine-learning screen of 2.6 million cancer articles, 2026 — verified; flagged, not proven fraud

• Silverchair, Future of Peer Review Report, 2026 — verified

• European Commission, EOSC Steering Board opinion, 17 December 2025 — verified

• SciELO, "Scientific Data Sovereignty in the tension between global openness and local autonomy," 17 December 2025 — verified

• DFG funding initiative for data resilience; Finland Digital Independence initiative, February 2026; Pakistan HEC Journals and Publications Policy, 5 November 2025 — verified