💻 computer science

Verifiable Provenance for AI Judicial Decision Support Using Transparency Logs and Citation Entailment

The paper introduces VADP, an auditable architecture for AI judicial decision support that integrates Zero-Trust access control, natural language inference, and transparency logs to create verifiable contracts ensuring evidentiary custody and explainability, while empirically demonstrating high defense rates against prompt injection and tampering alongside significant but jurisdiction-dependent performance gains and acknowledged limitations regarding cross-jurisdictional generalization and unverified cryptographic soundness.

Original authors: Aditya Mandloi, Anushka Yadav

Published 2026-10-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Aditya Mandloi, Anushka Yadav

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the high-stakes world of law, a judge's decision relies on a foundation of facts, precedents, and statutes. When artificial intelligence enters this arena to help research cases or draft summaries, a new problem emerges: how can a human be sure the machine is telling the truth? Unlike a calculator that simply crunches numbers, modern AI can sometimes invent facts or cite laws that do not exist, a phenomenon known as "hallucination." In a courtroom, such errors are not just mistakes; they can undermine justice. The challenge, therefore, is not just to build a smarter AI, but to build one that leaves a clear, unalterable trail of evidence for every single claim it makes, allowing a human to verify exactly where the information came from and whether it was authorized to be used.

Researchers Aditya Mandloi and Anushka Yadav have proposed a system called VADP, designed to solve this problem by wrapping every AI-generated legal recommendation in a digital "verification contract." Think of this contract as a sealed envelope that contains not just the AI's answer, but also the proof of how that answer was reached. The system works by first checking if the person asking the question has the right to see the information, much like a security guard checking a badge. It then retrieves relevant legal documents from a secure database and uses a second, specialized AI to double-check that the retrieved documents actually support the claims made by the first AI. If the documents do not support the claims, the system flags the error immediately. Finally, the entire process—from the user's identity to the specific legal text used—is locked into a digital record that cannot be changed without leaving a visible mark, similar to how a wax seal on a letter proves it has not been opened.

The researchers tested this system using a benchmark of 1,500 legal questions based on real Indian Supreme Court cases. The results showed that the system was highly effective at finding the correct legal precedents, ranking the most relevant document first in over 93% of the cases. More importantly, the system successfully caught nearly all instances where the AI tried to make up a citation or contradict the source material, intercepting about 94% of unsupported claims and 98% of direct contradictions. The digital "envelope" also proved to be incredibly robust; in tests where researchers attempted to tamper with the records by altering a single bit of data or changing a timestamp, the system detected the change 100% of the time, proving that the record remained intact.

However, the researchers are careful to distinguish between what their system can prove and what it cannot. While the system guarantees that the evidence was retrieved correctly and that the record has not been tampered with, it does not guarantee that the AI's final legal reasoning is perfect or that the judge will agree with the outcome. The system acts as a rigorous auditor of the process, not a replacement for human judgment. In fact, the study found that under the current settings, the system would still require a human judge to review about 68% of the cases to ensure safety, only allowing the remaining 32% to proceed without intervention. This high rate of human review is intentional, designed to keep the risk of missing a critical error below 5%.

The study also explored how well this approach would work in different legal systems, such as those in the United States or Europe. When tested on these foreign legal datasets without specific retraining, the system's performance dropped significantly, correctly identifying the top precedent in less than half of the cases. This suggests that while the underlying technology of verifying evidence is universal, the specific tools needed to find the right laws must be tailored to the specific country's legal code. The researchers also noted that their current tests were run on a single computer, and while the system worked perfectly there, it has not yet been tested in a live, multi-court environment where many users access the system simultaneously from different locations.

Ultimately, this work offers a new way to think about trust in artificial intelligence. Instead of asking a court to trust a vendor's promise that their software is safe, VADP provides a tangible, checkable artifact for every decision. It shifts the burden from blind faith to independent verification, ensuring that if a legal citation is used, it was actually retrieved from a secure source, and if a record is altered, the change is immediately obvious. While the system is not yet a finished product ready for every courtroom, it demonstrates that it is possible to build AI tools that are not only powerful but also transparent and accountable, giving judges and lawyers the tools they need to verify the truth before making life-altering decisions.

Technical Summary: Verifiable Provenance for AI Judicial Decision Support Using Transparency Logs and Citation Entailment

1. Problem Statement

The integration of Artificial Intelligence (AI) into judicial decision support systems faces a critical barrier: the inability to independently verify specific outputs without trusting the vendor or the black-box model itself. While aggregate system accuracy metrics exist, they do not satisfy the legal requirement for per-decision auditability, particularly regarding evidentiary custody, citation grounding, and authorization. Commercial legal AI tools are prone to hallucinating statutory citations and precedents (rates reported between 17–33%), and existing transparency mechanisms (like Model Cards) describe systems in aggregate rather than binding specific claims to specific artifacts. Furthermore, Indian legal frameworks, specifically Section 63(4) of the Bharatiya Sakshya Adhiniyam (BSA), 2023, mandate certified hash values and custody trails for electronic evidence, raising the technical bar for AI-assisted evidence processing.

The core research question is: How can an AI-assisted judicial recommendation be independently verified end-to-end—covering access authorization, evidence provenance, statutory citation grounding, feature attribution, human oversight, and cryptographic tamper-evidence—without placing uncritical trust in the AI model?

2. Methodology: The VADP Architecture

The authors propose VADP (Verifiable AI Decision Provenance), a domain-specific structural integration architecture rather than a new cryptographic primitive. VADP binds established components into a unified, independently auditable framework centered on a Seven-Field Verification Contract.

Core Components

Zero-Trust Access Control (ABAC): Enforces continuous, session-scoped verification using Attribute-Based Access Control (NIST SP 800-207) to ensure only authorized users can access specific case data.
Retrieval-Augmented Generation (RAG) with Entailment:
- Retrieval: Uses a multi-stage pipeline (FAISS dense retrieval + BM25 lexical retrieval) followed by a Gradient Boosted Tree (GBT) re-ranker.
- Citation Entailment: A Natural Language Inference (NLI) cross-encoder (DeBERTa-v3-large-MNLI) acts as a gate, verifying that generated legal claims strictly entail the retrieved source text. This bounds hallucinations by rejecting claims not supported by the retrieved premise.
Explainability (TreeSHAP): Applies TreeSHAP feature attribution exclusively to the retrieval re-ranker (not the generative model) to explain why specific precedents were ranked and retrieved.
Transparency Ledger: Utilizes an RFC 6962 Merkle-tree-based transparency log. Every decision artifact is hashed and anchored in an append-only ledger, providing cryptographic proof of inclusion and integrity.
Human Oversight & Risk Control: Implements a Conformal Risk-Control framework. It uses a calibrated Trust Score and a finite-sample risk bound (Theorem 2) to determine when a case must be escalated to human review, guaranteeing that the probability of missing a necessary escalation stays below a target risk level ( $\alpha$ ).

The Verification Contract

The central artifact is a signed tuple $C = (\phi_{auth}, \phi_{evid}, \phi_{cite}, \phi_{expl}, \sigma, \pi_{Merkle}, \phi_{review})$ containing:

Authorization Proof: Signed ABAC decision.
Evidence Provenance: Document hash and custody seal (referencing BSA §63(4)).
Citation Provenance: Permission-filtered citations validated via NLI.
Explainability Attribution: TreeSHAP values for the re-ranker.
Digital Signature: ECDSA-P256 or Ed25519 signature over the contract.
Merkle Inclusion Proof: Proof of the contract's presence in the audit ledger.
Human Review Status: Escalation routing and override logs.

3. Key Contributions

The paper identifies its contributions as structural and domain-specific integration rather than cryptographic innovation:

Seven-Field Verification Contract: A schema that binds authorization, evidentiary custody, citation grounding, retrieval explainability, and human oversight into a single, cryptographically signed, Merkle-anchored artifact.
Completeness Invariant: A mechanism ensuring that any silent omission or alteration of required fields renders the contract verifiable as incomplete.
Conformal Risk-Controlled Escalation: A finite-sample, distribution-free bound (Theorem 2) on the probability that an unescalated case warrants human review, calibrated against real appellate outcomes.
Formal Security Argument: A reduction-based proof (Theorem 1) demonstrating that forging a Verification Contract implies breaking the collision resistance of the hash function or the existential unforgeability of the signature scheme.
Empirical Validation: Large-scale evaluation of retrieval, adversarial tampering, and risk calibration on judicial datasets.

4. Experimental Results

The authors report results based on a 1,500-query judicial benchmark (ILDC corpus) and various adversarial tests.

Retrieval Performance: The VADP GBT re-ranker achieved a Mean Reciprocal Rank (MRR) of 0.951 and Precision@1 of 0.931, significantly outperforming standard Dense RAG (MRR 0.801) and Cross-Encoder baselines (MRR 0.918) while maintaining low latency (16.3 ms vs. 2,621 ms for Cross-Encoder).
Hallucination Detection: The NLI citation entailment gate intercepted 94.4% of ungrounded claims and 98.0% of direct contradictions.
Tamper Detection: Against 10,000 synthetically corrupted contracts (bit-flips, role swaps, citation forgery, timestamp tampering), the system achieved a 100.0% Tamper Detection Rate with a mean localization latency of ~0.029 ms.
Prompt Injection Defense: The defended pipeline achieved a 100.0% defense rate against 100 adversarial prompts, compared to an 11.0% defense rate for an undefended baseline.
Human Override Coverage (HOC): Under prototype thresholds, 68.25% of contracts were escalated for human review.
Conformal Risk Bound: Calibrated on 500 appellate cases and tested on a disjoint 200-case set, the system achieved an empirical miss rate of 4.50% against a target risk of $\alpha=0.05$ .
Cross-Jurisdictional Generalization: When retrained on disjoint splits for SCOTUS and ECtHR datasets, the system improved from zero-shot P@1 of ~0.48 to 0.684 (SCOTUS) and 0.612 (ECtHR), though these remain below in-domain performance (0.931).

5. Significance and Claims

The paper positions VADP as a domain-specific adaptation of existing transparency-log primitives (Certificate Transparency, Sigstore/Rekor, in-toto) to the judicial context.

Shift from Trust to Verification: The primary significance is shifting the burden of proof from "trusting the vendor" to "checking the artifact." It transforms an unfalsifiable trust claim into a falsifiable, cryptographically checkable record of what evidence was retrieved, what was flagged for review, and whether the artifact was altered.
Compliance with BSA 2023: The architecture is designed with reference to Section 63(4) of India's new evidence law to produce artifacts that courts could plausibly treat as satisfying certification requirements for electronic evidence.
Limitations and Modesty: The authors explicitly state that VADP does not explain the generative model's underlying legal reasoning (only the retrieval ranking), nor does it guarantee the substantive legal correctness of the recommendation.
- Deployment Scope: All infrastructure results (Hyperledger, HSM, ZK proofs) are validated on single-host setups; no live, multi-organization deployment has been evaluated.
- Cryptographic Assumptions: The security proof relies on standard assumptions (ECDSA/Ed25519 security, SHA-256 collision resistance) but does not independently verify these assumptions.
- Annotation Bias: Manual labeling for calibration was performed by the authors, and external legal expert audits are planned but not yet conducted.

In summary, VADP provides a structural framework for making AI judicial decisions independently auditable per output, addressing the "black box" concern by anchoring specific decisions in a verifiable chain of custody, authorization, and citation, while acknowledging that full deployment and external legal validation remain future work.